---
ssh_users_root:
  - equinox
  - datacop

network_mgmt_zone: "{{ network_zones.mgmt }}"

openwrt_variant: openwrt
openwrt_release: 19.07.7
openwrt_arch: ramips
openwrt_target: mt7620
openwrt_profile: ravpower_wd03
openwrt_output_image_suffixes:
  - "{{ openwrt_profile }}-squashfs-sysupgrade.bin"

openwrt_packages_remove:
  - ppp
  - ppp-mod-pppoe
  - dnsmasq
  - firewall
  - odhcpd
  - odhcpd-ipv6only
openwrt_packages_add:
  - haveged
  - htop
  - ip
  - less
  - nano
  - tcpdump-mini
  - usbutils
  - kmod-usb-storage
  - nut-server
  - nut-driver-usbhid-ups
  - nut-upsc
  - nut-upscmd
  - prometheus-node-exporter-lua
  - prometheus-node-exporter-lua-nat_traffic
  - prometheus-node-exporter-lua-netstat
  - prometheus-node-exporter-lua-openwrt


openwrt_mixin:
  /etc/dropbear/authorized_keys:
    content: "{{ ssh_keys_root | join('\n') }}\n"

  /etc/htoprc:
    file: "{{ global_files_dir }}/common/htoprc"

  /usr/bin/powercycle-ups:
    mode: "0755"
    content: |
      #!/bin/sh

      UPS="{{ inventory_hostname | regex_replace('^ele-ups-(.*)$', '\1') }}"

      upscmd -u admin -p secret "$UPS" load.off
      sleep 5
      upscmd -u admin -p secret "$UPS" load.on

  /etc/rc.d/S22network-fw:
    link: "../init.d/network-fw"

  /etc/rc.d/K92network-fw:
    link: "../init.d/network-fw"

  /etc/init.d/network-fw:
    mode: "0755"
    content: |
      #!/bin/sh /etc/rc.common

      START=22
      STOP=91

      start() {
        iptables -A INPUT -p tcp --dport 3493 -s 127.0.0.0/8 -j ACCEPT
        iptables -A INPUT -p tcp --dport 3493 -s {{ network_mgmt_zone.prefix | ipaddr(network_mgmt_zone.offsets['ele-mon']) | ipaddr('address') }} -j ACCEPT
        iptables -A INPUT -p tcp --dport 3493 -j DROP
      }

      stop() {
        iptables -D INPUT -p tcp --dport 3493 -j DROP
        iptables -D INPUT -p tcp --dport 3493 -s {{ network_mgmt_zone.prefix | ipaddr(network_mgmt_zone.offsets['ele-mon']) | ipaddr('address') }} -j ACCEPT
        iptables -D INPUT -p tcp --dport 3493 -s 127.0.0.0/8 -j ACCEPT
      }


openwrt_uci:
  system:
    - name: system
      options:
        hostname: '{{ host_name }}'
        timezone: 'CET-1CEST,M3.5.0,M10.5.0/3'
        ttylogin: '0'
        log_size: '64'
        urandom_seed: '0'

    - name: timeserver 'ntp'
      options:
        enabled: '1'
        enable_server: '0'
        server:
          - '0.lede.pool.ntp.org'
          - '1.lede.pool.ntp.org'
          - '2.lede.pool.ntp.org'
          - '3.lede.pool.ntp.org'

  dropbear:
    - name: dropbear
      options:
        PasswordAuth: 'off'
        RootPasswordAuth: 'off'
        Port: '{{ ansible_port }}'

  network:
    - name: globals 'globals'
      options:
        ula_prefix: "fc{{ '%02x:%04x:%04x' | format((255 | random(seed=inventory_hostname + '0')), (65535 | random(seed=inventory_hostname + '1')), (65535 | random(seed=inventory_hostname + '2'))) }}::/48"

    - name: interface 'loopback'
      options:
        ifname: lo
        proto: static
        ipaddr: 127.0.0.1
        netmask: 255.0.0.0

    - name: interface 'mgmt'
      options:
        ifname: "eth0"
        proto: static
        ipaddr: "{{ network_mgmt_zone.prefix | ipaddr(network_mgmt_zone.offsets[inventory_hostname]) | ipaddr('address') }}"
        netmask: "{{ network_mgmt_zone.prefix | ipaddr('netmask') }}"
        accept_ra: 0

  prometheus-node-exporter-lua:
    - name: prometheus-node-exporter-lua 'main'
      options:
        listen_interface: 'mgmt'
        listen_ipv6: '0'
        listen_port: '9100'

  nut_server:
    - name: listen_address
      options:
        address: 0.0.0.0

    - name: "driver '{{ inventory_hostname | regex_replace('^ele-ups-(.*)$', '\\1') }}'"
      options:
        driver: usbhid-ups
        port: auto
        enable_usb_serial: 0

    - name: user
      options:
        username: admin
        password: secret
        instcmd:
          - ALL