From 8197ca415f7eb1cbec981c3de82dca1d74b2e1f2 Mon Sep 17 00:00:00 2001
From: joshsiv-mulga <mrk@mulgadc.com>
Date: Mon, 25 May 2026 16:08:04 +1000
Subject: [PATCH] fix(ovn): install strongswan-charon (not strongswan
 metapackage)

The strongswan metapackage's '\''charon-systemd | strongswan-charon'\''
alternative resolves to charon-systemd by default, which ships
/usr/sbin/charon-systemd but not the legacy /usr/sbin/ipsec helper or
/usr/lib/ipsec/charon binary that ovs-monitor-ipsec --ike-daemon=strongswan
shells out to. Install strongswan-charon explicitly to pull
strongswan-starter (legacy ipsec controller) + the matching charon binary,
matching what openvswitch-ipsec.service expects.

Also reset-failed + restart openvswitch-ipsec.service after enable to
recover from the deb post-install starting the service before its
dependencies finished unpacking.
---
 scripts/setup-ovn.sh | 23 ++++++++++++++++++-----
 scripts/setup.sh     |  2 +-
 2 files changed, 19 insertions(+), 6 deletions(-)

diff --git a/scripts/setup-ovn.sh b/scripts/setup-ovn.sh
index 9c9041863..a8b6732ba 100755
--- a/scripts/setup-ovn.sh
+++ b/scripts/setup-ovn.sh
@@ -206,10 +206,17 @@ echo "Step 1: Checking OVN/OVS packages..."
 
 install_packages() {
     local missing=()
-    # strongswan: IKE daemon required by ovs-monitor-ipsec. openvswitch-ipsec
-    # only Recommends it, so install explicitly so a Recommends-disabled apt
-    # config can't leave openvswitch-ipsec.service failing on missing IKE.
-    for pkg in openvswitch-switch ovn-host openvswitch-ipsec strongswan; do
+    # strongswan-charon: ovs-monitor-ipsec is invoked with
+    # `--ike-daemon=strongswan` and shells out to /usr/sbin/ipsec (the legacy
+    # starter command, from strongswan-starter) which in turn execs
+    # /usr/lib/ipsec/charon (from strongswan-charon). Picking
+    # strongswan-charon explicitly avoids apt's default of pulling the
+    # alternative charon-systemd, which ships /usr/sbin/charon-systemd
+    # instead and leaves the starter unable to find a daemon to exec.
+    # strongswan-charon brings strongswan-starter, strongswan-libcharon,
+    # libstrongswan, strongswan-swanctl, and the strongswan metapackage
+    # transitively.
+    for pkg in openvswitch-switch ovn-host openvswitch-ipsec strongswan-charon; do
         if ! dpkg -s "$pkg" >/dev/null 2>&1; then
             missing+=("$pkg")
         fi
@@ -728,7 +735,13 @@ sudo systemctl enable ovn-controller 2>/dev/null || true
 # enableOVNIPSec() flips ipsec_encapsulation=true at runtime and silently drops
 # tunnel traffic if this unit isn't already up — enable at provision time so
 # daemon never needs systemd-write capability (only is-active read).
-sudo systemctl enable --now openvswitch-ipsec.service 2>/dev/null || true
+sudo systemctl enable openvswitch-ipsec.service 2>/dev/null || true
+# When openvswitch-ipsec is installed before strongswan-starter, the deb
+# post-install starts the service against a missing /usr/sbin/ipsec and
+# leaves it in 'failed' state. Clear the failure and restart unconditionally
+# now that strongswan-starter is present.
+sudo systemctl reset-failed openvswitch-ipsec.service 2>/dev/null || true
+sudo systemctl restart openvswitch-ipsec.service 2>/dev/null || true
 echo "  openvswitch-switch:   enabled on boot"
 echo "  ovn-controller:       enabled on boot"
 echo "  openvswitch-ipsec:    enabled on boot"
diff --git a/scripts/setup.sh b/scripts/setup.sh
index 5e3dc0d9a..7220ed1c6 100755
--- a/scripts/setup.sh
+++ b/scripts/setup.sh
@@ -219,7 +219,7 @@ install_apt_deps() {
             libvirt-daemon-system libvirt-clients \
             pciutils \
             jq curl iproute2 netcat-openbsd wget unzip xz-utils file \
-            ovn-central ovn-host openvswitch-switch openvswitch-ipsec dhcpcd-base \
+            ovn-central ovn-host openvswitch-switch openvswitch-ipsec strongswan-charon dhcpcd-base \
             > /dev/null
 
         info "System dependencies installed"