From d8e63b60a6ce07cde8f841af7d07c1ef0ae05955 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alby=20Hern=C3=A1ndez?= <donfumero@gmail.com>
Date: Wed, 24 Jun 2026 19:06:38 +0100
Subject: [PATCH] refactor: drop dead netdev validator and comments that
 describe other layers

- remove validateNetdev (a constant-nil placeholder kept "for future fields")
- drop the Apply comment explaining the planner's per-node decision inside the
  generic applier; the other sections carry no such comment
- tighten the NetdevConfig doc comment to what the type is, not how tunnelctl
  applies it
---
 internal/agentconfig/agentconfig.go       | 12 ------------
 internal/agentconfig/agentconfig_types.go | 21 +++++++++------------
 internal/agentrun/agentrun.go             |  3 ---
 3 files changed, 9 insertions(+), 27 deletions(-)

diff --git a/internal/agentconfig/agentconfig.go b/internal/agentconfig/agentconfig.go
index e0556dc..37561cc 100644
--- a/internal/agentconfig/agentconfig.go
+++ b/internal/agentconfig/agentconfig.go
@@ -71,9 +71,6 @@ func (d *Document) Validate() error {
 	if err := validateNftables(d.Nftables); err != nil {
 		return err
 	}
-	if err := validateNetdev(d.Netdev); err != nil {
-		return err
-	}
 	return nil
 }
 
@@ -155,15 +152,6 @@ func validateNftables(nft *NftablesConfig) error {
 	return nil
 }
 
-// validateNetdev checks the netdev section. Both a nil section (the NIC is left
-// untouched) and a present section are valid: the section carries only a boolean
-// toggle, so there is nothing to constrain. It exists to keep the validation
-// surface uniform and ready for future fields.
-func validateNetdev(nd *NetdevConfig) error {
-	_ = nd
-	return nil
-}
-
 // validateRule checks every field of the NftablesRule at index i. It returns
 // the first violation found, naming the offending field.
 func validateRule(i int, rule NftablesRule) error {
diff --git a/internal/agentconfig/agentconfig_types.go b/internal/agentconfig/agentconfig_types.go
index 5b78cf9..e5c7571 100644
--- a/internal/agentconfig/agentconfig_types.go
+++ b/internal/agentconfig/agentconfig_types.go
@@ -21,22 +21,19 @@ type Document struct {
 	WireGuard WireGuardConfig `json:"wireguard"`
 	// Nftables is the optional DNAT ruleset; set only on uplink nodes.
 	Nftables *NftablesConfig `json:"nftables,omitempty"`
-	// Netdev is the optional host NIC tuning section. A nil section is a no-op
-	// (the NIC is left untouched); when present it is applied wherever the
-	// document carries it, independent of the node role.
+	// Netdev is the optional host NIC tuning section. A nil section leaves the
+	// NIC untouched.
 	Netdev *NetdevConfig `json:"netdev,omitempty"`
 }
 
-// NetdevConfig tunes the underlay network interface of the host. tunnelctl
-// resolves the underlay interface itself at apply time (the device of the
-// default route to a public IP), so this section carries only the desired
-// behavior and never an interface name. A nil section means leave the NIC
-// untouched; presence with DisableOffloads true turns the offloads off.
+// NetdevConfig tunes the underlay network interface of the host. It carries the
+// desired behavior only, never an interface name: the underlay device is
+// resolved at apply time.
 type NetdevConfig struct {
-	// DisableOffloads turns GRO and GSO off on the resolved underlay NIC. It is
-	// intended for encapsulated/non-uniform UDP payloads where GRO coalescing
-	// can corrupt datagram boundaries; it defaults off because disabling it
-	// degrades throughput for ordinary TCP/QUIC traffic.
+	// DisableOffloads turns GRO and GSO off on the underlay NIC. It is for
+	// encapsulated, non-uniform UDP payloads where receive coalescing corrupts
+	// datagram boundaries; off by default because it degrades throughput for
+	// ordinary TCP/QUIC traffic.
 	DisableOffloads bool `json:"disableOffloads"`
 }
 
diff --git a/internal/agentrun/agentrun.go b/internal/agentrun/agentrun.go
index 4cbbb10..018e167 100644
--- a/internal/agentrun/agentrun.go
+++ b/internal/agentrun/agentrun.go
@@ -63,9 +63,6 @@ func Apply(doc *agentconfig.Document) error {
 			return err
 		}
 	}
-	// netdev tunes the host underlay NIC. A nil section is left untouched; a
-	// present section is applied wherever the document carries it, regardless of
-	// node role (the relay carries it when the EdgeNode requests it).
 	if doc.Netdev != nil {
 		if err := applyNetdev(*doc.Netdev); err != nil {
 			return err