Remove SNX Waybar integration

5 files changed, 2 insertions, 80 deletions

diff --git a/dot_config/waybar/config.jsonc b/dot_config/waybar/config.jsonc
index 4d38f64..89a8ea9 100644
--- a/dot_config/waybar/config.jsonc
+++ b/dot_config/waybar/config.jsonc
@@ -10,7 +10,6 @@
     "temperature",
     "custom/memory",
     "custom/vpn",
-    "custom/snx-vpn",
     "network#bond",
     "custom/dock",
     "battery",
@@ -121,14 +120,6 @@
     "on-click": "~/.config/waybar/vpn-toggle.sh",
   },
 
-  "custom/snx-vpn": {
-    "exec": "~/.config/waybar/snx-vpn-status.sh",
-    "return-type": "json",
-    "interval": 5,
-    "signal": 9,
-    "on-click": "~/.config/waybar/snx-vpn-toggle.sh",
-  },
-
   "battery": {
     "format": "{icon} {capacity}%",
     "format-charging": "󰂄 {capacity}%",
diff --git a/dot_config/waybar/executable_snx-vpn-status.sh b/dot_config/waybar/executable_snx-vpn-status.sh
deleted file mode 100644
index f88c3a0..0000000
--- a/dot_config/waybar/executable_snx-vpn-status.sh
+++ /dev/null
@@ -1,20 +0,0 @@
-#!/usr/bin/env dash
-# Waybar custom/snx-vpn module: report the snx-rs (Check Point) tunnel
-# state. `snxctl status` is fast (talks over a local UDS to the daemon)
-# but might briefly stall during connect; cap it with `timeout`.
-
-# Bail out if the daemon socket isn't even there (snx-rs.service stopped).
-out=$(timeout 2 snxctl status 2>/dev/null) || out=
-
-case "$out" in
-  '' | *"Disconnected"*)
-    printf '{"text":"<span color=\\"#928374\\"><s>󰌾 SNX</s></span>","class":"down","tooltip":"snx-rs disconnected — click to connect"}\n'
-    ;;
-  *"Connecting"* | *"MFA pending"*)
-    printf '{"text":"<span color=\\"#fabd2f\\">󰌾 SNX…</span>","class":"connecting","tooltip":"%s"}\n' "$(echo "$out" | head -1)"
-    ;;
-  *)
-    tooltip=$(echo "$out" | sed 's/"/\\"/g' | awk 'BEGIN{ORS="\\n"}{print}')
-    printf '{"text":"<span color=\\"#b8bb26\\">󰌾 SNX</span>","class":"up","tooltip":"%s"}\n' "$tooltip"
-    ;;
-esac
diff --git a/dot_config/waybar/executable_snx-vpn-toggle.sh b/dot_config/waybar/executable_snx-vpn-toggle.sh
deleted file mode 100644
index 80ced4c..0000000
--- a/dot_config/waybar/executable_snx-vpn-toggle.sh
+++ /dev/null
@@ -1,19 +0,0 @@
-#!/usr/bin/env dash
-# Toggle the snx-rs (Check Point) tunnel.
-#
-# Refresh the waybar custom/snx-vpn module immediately with SIGRTMIN+9.
-set -eu
-
-state=$(timeout 2 snxctl status 2>/dev/null || echo Disconnected)
-
-case "$state" in
-  *"Disconnected"*)
-    setsid -f snxctl connect >/tmp/snxctl.log 2>&1 &
-    ;;
-  *)
-    snxctl disconnect >/dev/null 2>&1 || true
-    ;;
-esac
-
-pid=$(pidof waybar || true)
-if [ -n "$pid" ]; then kill -SIGRTMIN+9 "$pid" 2>/dev/null || true; fi
diff --git a/etc/systemd/system-sleep/50-snx-rs b/etc/systemd/system-sleep/50-snx-rs
deleted file mode 100755
index 3738f72..0000000
--- a/etc/systemd/system-sleep/50-snx-rs
+++ /dev/null
@@ -1,32 +0,0 @@
-#!/bin/sh
-# Bounce the system-scope snx-rs (Check Point) tunnel around suspend/hibernate.
-#
-# Problem: during suspend the IKE SA keepalive is interrupted and the SAML
-# session cookie may expire. snx-rs doesn't detect this — the daemon
-# happily sits on dead sockets after resume, so `snxctl status` reports
-# "Connected" while no traffic actually goes through. The user has to
-# manually disconnect+reconnect (which re-triggers the SAML browser flow).
-#
-# Fix: stop the daemon before suspend, start it after resume. The tunnel
-# is left disconnected on resume — user clicks the waybar toggle (or any
-# `snxctl connect`) to re-establish, which goes through SAML if and only
-# if the cached cookie has actually expired. Net result:
-#   - waybar correctly shows "disconnected" immediately on resume
-#   - one click reconnects (often without re-doing SAML)
-#   - no stale "Connected"-but-dead state
-#
-# Invoked by systemd-suspend(8) / -hibernate / -hybrid-sleep with
-#   $1 = pre|post   $2 = suspend|hibernate|hybrid-sleep|suspend-then-hibernate
-set -eu
-
-case "$1" in
-  pre) action=stop ;;
-  post) action=start ;;
-  *) exit 0 ;;
-esac
-
-# The command-mode daemon runs as a system service because it configures
-# routes, DNS, and tunnel interfaces. Ignore missing/disabled states so this
-# hook remains harmless on non-work profiles.
-systemctl is-enabled snx-rs.service >/dev/null 2>&1 || exit 0
-systemctl "$action" snx-rs.service || true
diff --git a/run_onchange_after_deploy-etc.sh.tmpl b/run_onchange_after_deploy-etc.sh.tmpl
index 45e5c26..742ef82 100755
--- a/run_onchange_after_deploy-etc.sh.tmpl
+++ b/run_onchange_after_deploy-etc.sh.tmpl
@@ -38,6 +38,8 @@ fi
 # sudo-rs: /etc/pam.d/sudo-i is a symlink to /etc/pam.d/sudo
 sudo ln -sfT sudo /etc/pam.d/sudo-i
 
+sudo rm -f /etc/systemd/system-sleep/50-snx-rs
+
 # Clean up sleep-target masks from the earlier hardened-suspend
 # workaround. Now that mem_sleep_default=s2idle resolves the wake hang,
 # suspend is enabled again. Remove any leftover /dev/null symlinks.