Fix gateway direct-mode not triggering on VPN disconnect

The gateway-direct-mode.service was never triggering when WireGuard
interfaces were removed, leaving VPN iptables rules active even when
VPN was disconnected. This caused internet connectivity to fail in
direct mode.

Root cause: SYSTEMD_WANTS in udev rules only works for ACTION=="add"
events. When a device is removed, the device unit is already gone
before systemd can process the SYSTEMD_WANTS dependency, so the
service never starts. This is a documented systemd limitation.

Fix: Replace SYSTEMD_WANTS with RUN+ for the remove action, which
executes systemctl directly during udev event processing without
requiring a device unit to exist.

References:
- https://stackoverflow.com/questions/72208534/why-does-systemd-wants-not-pass-a-parameter-to-a-service-file-from-a-udev-remov
- https://stackoverflow.com/questions/73148448/how-to-start-systemd-user-service-when-device-is-removed-and-stop-it-when-devic
- https://bugzilla.redhat.com/show_bug.cgi?id=871074https://bugzilla.redhat.com/show_bug.cgi?id=871074
- https://unix.stackexchange.com/questions/528803/systemd-doesnt-stop-the-service-when-the-device-is-removed

The VPN mode (ACTION=="add") continues to use SYSTEMD_WANTS as it
works correctly for device addition events.

1 files changed, 1 insertions, 1 deletions

diff --git a/roles/gateway/templates/99-wireguard-gateway.rules.j2 b/roles/gateway/templates/99-wireguard-gateway.rules.j2
index a4164bc3..6bc5d2a0 100644
--- a/roles/gateway/templates/99-wireguard-gateway.rules.j2
+++ b/roles/gateway/templates/99-wireguard-gateway.rules.j2
@@ -1,2 +1,2 @@
 ACTION=="add", SUBSYSTEM=="net", KERNEL=="wg*", TAG+="systemd", ENV{SYSTEMD_WANTS}="gateway-vpn-mode.service"
-ACTION=="remove", SUBSYSTEM=="net", KERNEL=="wg*", TAG+="systemd", ENV{SYSTEMD_WANTS}="gateway-direct-mode.service"
+ACTION=="remove", SUBSYSTEM=="net", KERNEL=="wg*", RUN+="/usr/bin/systemctl start gateway-direct-mode.service"