fix(ipsec): use Debian unit name openvswitch-ipsec.service

CI artifact shows `Unit ovs-monitor-ipsec.service could not be found`
on every node. Debian's openvswitch-ipsec package ships the unit as
openvswitch-ipsec.service (the binary inside is ovs-monitor-ipsec, but
systemd's name follows the package). The previous commit guarded on
the wrong unit name, so:

- spinifex-daemon.service Wants=/After= silently no-op'd (missing unit)
- enableOVNIPSec's `systemctl enable --now ovs-monitor-ipsec.service`
  failed, daemon logged a warning and continued without flipping
  ipsec_encapsulation=true
- TestMultinodeIPSec skipped with `node1 reports ""` because OVS DB
  never received the cert pointers

Rename across all 5 spots (daemon, systemd unit, test, CI diag script,
workflow journal capture) to match the Debian package layout.

Note: the package itself still must be present on the CI VM image —
that's tracked in the mulga repo (image-builder provision.sh +
bootstrap-install.sh shim).

Refs: mulga-siv-136

.github/scripts/capture-net-diag.sh

@@ -6,8 +6,8 @@
 # binary on one path doesn't abort the rest of the capture.
 #
 # Output layout (under $1/net-diag/):
-#   ovs-monitor-ipsec.status         systemctl status (output-only)
-#   ovs-monitor-ipsec.journal        last 200 journal lines
+#   openvswitch-ipsec.status         systemctl status (output-only)
+#   openvswitch-ipsec.journal        last 200 journal lines
 #   ipsec.openvswitch_conf           ovs-vsctl get Open_vSwitch . other_config
 #   ipsec.xfrm_state                 ip xfrm state list
 #   ipsec.xfrm_policy                ip xfrm policy list
@@ -32,8 +32,8 @@ run() {
     } > "$OUT/$label" || true
 }
 
-run ovs-monitor-ipsec.status            sudo systemctl status ovs-monitor-ipsec.service --no-pager --full --lines=50
-run ovs-monitor-ipsec.journal           sudo journalctl -u ovs-monitor-ipsec.service --no-pager --output=short-iso -n 200
+run openvswitch-ipsec.status            sudo systemctl status openvswitch-ipsec.service --no-pager --full --lines=50
+run openvswitch-ipsec.journal           sudo journalctl -u openvswitch-ipsec.service --no-pager --output=short-iso -n 200
 run ipsec.openvswitch_conf              sudo ovs-vsctl get Open_vSwitch . other_config
 run ipsec.xfrm_state                    sudo ip xfrm state list
 run ipsec.xfrm_policy                   sudo ip xfrm policy list

.github/workflows/e2e-go.yml

@@ -728,12 +728,14 @@ jobs:
               > "${ARTIFACT_DIR}/spinifex-journal-node${idx}.log" 2>/dev/null
             ok "journal node${idx}: $(wc -l < "${ARTIFACT_DIR}/spinifex-journal-node${idx}.log" 2>/dev/null || echo 0) lines"
           done
-          # ovs-monitor-ipsec journal per node (separate file — bead 136).
+          # openvswitch-ipsec journal per node (separate file — bead 136).
+          # Debian unit name; the binary inside is /usr/share/openvswitch/scripts/ovs-ctl
+          # which spawns ovs-monitor-ipsec as a child.
           for i in "${!NODE_LIST[@]}"; do
             idx=$((i + 1))
             ip="${NODE_LIST[$i]}"
-            ssh "${SSH_OPTS[@]}" tf-user@"$ip" 'sudo journalctl -u ovs-monitor-ipsec.service --no-pager --output=short-iso --since "60 min ago"' \
-              > "${ARTIFACT_DIR}/ovs-monitor-ipsec-node${idx}.log" 2>/dev/null
+            ssh "${SSH_OPTS[@]}" tf-user@"$ip" 'sudo journalctl -u openvswitch-ipsec.service --no-pager --output=short-iso --since "60 min ago"' \
+              > "${ARTIFACT_DIR}/openvswitch-ipsec-node${idx}.log" 2>/dev/null
           done
 
       - name: Convert test logs to JUnit XML

build/systemd/spinifex-daemon.service

@@ -1,14 +1,14 @@
 [Unit]
 Description=Spinifex Daemon (VM Orchestration)
 PartOf=spinifex.target
-After=spinifex-nats.service spinifex-viperblock.service openvswitch-switch.service ovn-controller.service ovs-monitor-ipsec.service
-# Wants=ovs-monitor-ipsec.service so systemd brings the IPsec userspace
+After=spinifex-nats.service spinifex-viperblock.service openvswitch-switch.service ovn-controller.service openvswitch-ipsec.service
+# Wants=openvswitch-ipsec.service so systemd brings the IPsec userspace
 # daemon up before spinifex flips other_config:ipsec_encapsulation=true.
 # Without that daemon, OVS holds the cert pointers unused and strongSwan
 # never gets IKE config — tunnel traffic is encrypted with no SAs and
 # silently dropped. Wants= (not Requires=) keeps daemon bootable on
 # single-node / lab hosts where the package is intentionally absent.
-Wants=ovs-monitor-ipsec.service
+Wants=openvswitch-ipsec.service
 # No Wants=spinifex-nats.service: Wants= reactivates a stopped unit during
 # `systemctl restart spinifex-daemon`, which would mask the standalone-startup
 # path the Tier 1 DDIL Scenario B exercises. spinifex.target Wants= covers

spinifex/daemon/ipsec.go

@@ -12,7 +12,7 @@ import (
 )
 
 // systemctlActiveTimeout bounds how long enableOVNIPSec waits for
-// ovs-monitor-ipsec.service to report active after a `systemctl enable
+// openvswitch-ipsec.service to report active after a `systemctl enable
 // --now`. Overridden in tests.
 var systemctlActiveTimeout = 5 * time.Second
 
@@ -79,18 +79,18 @@ func (d *Daemon) enableOVNIPSec() error {
 	return nil
 }
 
-// ensureOVSMonitorIPSecActive enables + starts ovs-monitor-ipsec.service and
+// ensureOVSMonitorIPSecActive enables + starts openvswitch-ipsec.service and
 // waits for it to report active. Without this guarantee, ipsec_encapsulation
 // silently drops all tunnel traffic because no userspace daemon is reading
 // the OVS DB cert pointers to drive strongSwan IKE.
 func ensureOVSMonitorIPSecActive() error {
-	if out, err := sudoCommand("systemctl", "enable", "--now", "ovs-monitor-ipsec.service").CombinedOutput(); err != nil {
+	if out, err := sudoCommand("systemctl", "enable", "--now", "openvswitch-ipsec.service").CombinedOutput(); err != nil {
 		return fmt.Errorf("enable --now: %s: %w", strings.TrimSpace(string(out)), err)
 	}
 	deadline := time.Now().Add(systemctlActiveTimeout)
 	var lastOut string
 	for time.Now().Before(deadline) {
-		out, _ := sudoCommand("systemctl", "is-active", "ovs-monitor-ipsec.service").CombinedOutput()
+		out, _ := sudoCommand("systemctl", "is-active", "openvswitch-ipsec.service").CombinedOutput()
 		lastOut = strings.TrimSpace(string(out))
 		if lastOut == "active" {
 			return nil

spinifex/daemon/ipsec_test.go

@@ -65,13 +65,13 @@ func TestEnableOVNIPSec(t *testing.T) {
 	require.NoError(t, d.enableOVNIPSec())
 
 	// Expected sudo invocations in order:
-	//   systemctl enable --now ovs-monitor-ipsec.service
-	//   systemctl is-active ovs-monitor-ipsec.service
+	//   systemctl enable --now openvswitch-ipsec.service
+	//   systemctl is-active openvswitch-ipsec.service
 	//   ovs-vsctl set Open_vSwitch . other_config:certificate=... private_key=... ca_cert=...
 	//   ovs-vsctl set Open_vSwitch . other_config:ipsec_encapsulation=true
 	require.Len(t, recorder.runs, 4)
-	assert.Equal(t, []string{"systemctl", "enable", "--now", "ovs-monitor-ipsec.service"}, recorder.runs[0])
-	assert.Equal(t, []string{"systemctl", "is-active", "ovs-monitor-ipsec.service"}, recorder.runs[1])
+	assert.Equal(t, []string{"systemctl", "enable", "--now", "openvswitch-ipsec.service"}, recorder.runs[0])
+	assert.Equal(t, []string{"systemctl", "is-active", "openvswitch-ipsec.service"}, recorder.runs[1])
 	for _, run := range recorder.runs[2:] {
 		assert.Equal(t, "ovs-vsctl", run[0])
 		assert.Equal(t, "set", run[1])