sync infra

examples/network/README.md

@@ -0,0 +1,61 @@
+# Edge network probes
+
+Scripts for the **Debian router** (`134.17.26.161` / `10.7.6.228`) — not FE/BE app hosts.
+
+## `wan-snapshot.sh`
+
+Periodic ping comparison:
+
+| Target | Default | Meaning |
+|--------|---------|---------|
+| **WAN** | `1.1.1.1` | ISP/upstream leg (outbound from router) |
+| **FE** | `10.7.0.10` | LAN leg router → Gentoo FE |
+| **BE** | `10.7.16.128` | Optional deeper LAN (disable: `BE_PING_TARGET=none`) |
+
+### Install (router)
+
+```bash
+sudo cp examples/network/wan-snapshot.sh /usr/local/bin/wan-snapshot.sh
+sudo chmod +x /usr/local/bin/wan-snapshot.sh
+```
+
+### Cron (every 15 minutes)
+
+```cron
+*/15 * * * * root /usr/local/bin/wan-snapshot.sh >>/var/log/wan-quality.cron.log 2>&1
+```
+
+Log: `/var/log/wan-quality.log` (override with `WAN_SNAPSHOT_LOG`).
+
+### Usage
+
+```bash
+# one line appended + printed
+sudo /usr/local/bin/wan-snapshot.sh
+
+# compare tonight vs yesterday
+/usr/local/bin/wan-snapshot.sh --report
+
+# recent samples
+/usr/local/bin/wan-snapshot.sh --tail 48
+```
+
+Example log line:
+
+```text
+ts=2026-06-04T21:15:01+02:00 wan=1.1.1.1 wan_loss=0% wan_avg_ms=11.2 fe=10.7.0.10 fe_loss=0% fe_avg_ms=0.3 be=10.7.16.128 be_loss=0% be_avg_ms=0.5
+```
+
+### Reading results
+
+- **`wan_avg_ms` high, `fe_avg_ms` low** → ISP/upstream (your “rocketship vs gap” bet).
+- **Both high** → router CPU, conntrack, or local link.
+- **Ping good, HTTPS/git slow** → DNAT or service layer (not measured here).
+
+From **outside** LAN, still run occasionally:
+
+```bash
+mtr -rwzc 50 134.17.26.161
+```
+
+That catches path issues ping from the router cannot see.