Run protect-subnets dispatcher script via no-wait.d

tailscale/rootfs/etc/NetworkManager/dispatcher.d/no-wait.d/protect-subnets

@@ -0,0 +1,44 @@
+#!/command/with-contenv-merge bashio
+# shellcheck shell=bash
+export LOG_FD
+# The shebang 'with-contenv-merge' above is identical with 'with-contenv', but doesn't clear the current environment containing the dispatcher variables
+
+# Redirect outputs to the log (&2 is already set up as pipe by s6)
+exec 1>&2
+if [[ "${LOG_FD:-}" =~ ^[0-9]+$ ]]; then
+  eval "exec ${LOG_FD}>&1" || true
+fi
+
+function halt-app() {
+  bashio::log.error "Failed to protect subnet routes. Halting app to prevent network loss."
+  echo -n 1 > /run/s6-linux-init-container-results/exitcode
+  exec /run/s6/basedir/bin/halt
+}
+
+case "${NM_DISPATCHER_ACTION}" in
+  up|down)
+    bashio::log.info "Handling Network Manager action ${DEVICE_IP_IFACE-} ${NM_DISPATCHER_ACTION}"
+    unprotect-subnet-routes
+    if ! protect-subnet-routes; then
+      # Better stop app than risking losing all network connections
+      halt-app
+    fi
+    ;;
+  dhcp4-change|dhcp6-change)
+    # Do anything only when the addresses are really changed
+    if [[ "$(unprotect-subnet-routes test)" != "$(protect-subnet-routes test)" ]]; then
+      bashio::log.info "Handling Network Manager action ${DEVICE_IP_IFACE-} ${NM_DISPATCHER_ACTION}"
+      unprotect-subnet-routes
+      if ! protect-subnet-routes tested; then
+        # Better stop app than risking losing all network connections
+        halt-app
+      fi
+    fi
+    ;;
+  connectivity-change)
+    bashio::log.debug "Unhandled Network Manager action ${NM_DISPATCHER_ACTION} ${CONNECTIVITY_STATE-}"
+    ;;
+  *)
+    bashio::log.debug "Unhandled Network Manager action ${DEVICE_IP_IFACE-} ${NM_DISPATCHER_ACTION}"
+    ;;
+esac

tailscale/rootfs/etc/NetworkManager/dispatcher.d/protect-subnets

@@ -0,0 +1 @@
+no-wait.d/protect-subnets