VPN work-hours auto-connect: connect-only reconciler (Mon-Fri 09:00-16:00 ART), never disconnects, exponential backoff on failed connect

Sub-tickets

Questions

Activity

• system created · 2026-06-04
  wi cli
• system commented · 2026-06-04
  Design (Elazar-confirmed 2026-06-04). CONNECT-ONLY reconciler, whey-only. RULE: VPN connects iff inside Mon-Fri 09:00-16:00 America/Argentina/Buenos_Aires AND currently down -> vpn.sh start. NEVER disconnects (Elazar: no forced 4pm kill - it drops naturally; forced disconnect would kill his movilba ssh sessions). Outside window: no-op (natural drop persists till next morning; no robotic 3am reconnect). Backoff on consecutive failed connects 2->4->8->15min cap, reset on success (Elazar confirmed ASI blocks N min on hammering). Mild morning jitter so connect isn't robotic 09:00:00. Owner split: bin-whey-cc writes vpn-workhours.sh (PATH lane); nw-whey-cc deploys systemd service+timer on whey /etc (inline-TZ ART, RandomizedDelaySec). Supersedes the now-trashed vpnwatch.sh (which restarted every 5s 24/7).
• system completed · 2026-06-04
  Live on whey. vpn-workhours.sh v1.0 (bin-whey-cc, sh.git f658ee9) + systemd vpn-workhours.service/.timer deployed to /etc/systemd/system (nw-whey-cc). Type=oneshot User=root, TZ + PATH pinned in unit, ExecStart via bash (file landed 0664), OnUnitActiveSec=120 + RandomizedDelaySec=120 jitter. Verified: units parse, enabled+active, manual run detected VPN up -> exit 0 (no live-fire), next fire jittered. Connect-only, self-disables on venus/lezama.