---
openwrt_variant: openwrt
openwrt_release: 18.06.4
openwrt_arch: x86
openwrt_target: 64
openwrt_profile: Generic
openwrt_output_image_suffixes:
  - "rootfs-ext4.img.gz"
  - "vmlinuz"

openwrt_packages_remove:
  - ppp
  - ppp-mod-pppoe
  - dnsmasq
  - firewall
  - odhcpd
  - odhcpd-ipv6only
openwrt_packages_add:
  - rng-tools
  - htop
  - ip
  - less
  - nano
  - tcpdump-mini
  - iperf
  - mtr
  - usbutils
  - kmod-ipt-nat
  - kmod-ipt-conntrack


openwrt_mixin:
  /etc/dropbear/authorized_keys:
    content: "{{ ssh_keys_root | join('\n') }}\n"

  /etc/htoprc:
    file: "{{ global_files_dir }}/common/htoprc"

  /etc/rc.d/S22network-fw:
    link: "../init.d/network-fw"

  /etc/rc.d/K91network-fw:
    link: "../init.d/network-fw"

  /etc/init.d/network-fw:
    mode: "0755"
    content: |
      #!/bin/sh /etc/rc.common

      START=22
      STOP=91

      start() {
        MAGENTA_IF=$(uci get network.magenta.ifname)
        MAGENTA_IPADDR=$(uci get network.magenta.ipaddr)
        MAGENTA_NETMASK=$(uci get network.magenta.netmask)

        MGMT_IF=$(uci get network.mgmt.ifname)
        MGMT_IPADDR=$(uci get network.mgmt.ipaddr)
        MGMT_NETMASK=$(uci get network.mgmt.netmask)

        SVC_IF=$(uci get "network.svc.ifname")
        SVC_IPADDR=$(uci get "network.svc.ipaddr")
        SVC_NETMASK=$(uci get "network.svc.netmask")

        SSH_PORT=$(uci get dropbear.@dropbear[0].Port)

        iptables -A INPUT -i lo -d 127.0.0.0/8 -s 127.0.0.0/8 -j ACCEPT
        iptables -A INPUT -i "$MGMT_IF" -d "$MGMT_IPADDR" -s "$MGMT_IPADDR/$MGMT_NETMASK" -j ACCEPT

        iptables -A INPUT -i "$MAGENTA_IF" -d "$MAGENTA_IPADDR" -p icmp -j ACCEPT
        iptables -A INPUT -i "$MAGENTA_IF" -d "$MAGENTA_IPADDR" -p tcp --dport "$SSH_PORT" -j ACCEPT
        iptables -A INPUT -i "$MAGENTA_IF" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

        iptables -A INPUT -i "$SVC_IF" -p icmp -d "$SVC_IPADDR" -s "$SVC_IPADDR/$SVC_NETMASK" -j ACCEPT
        iptables -A INPUT -i "$SVC_IF" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
        iptables -A FORWARD -i "$SVC_IF" -o "$MAGENTA_IF" -s "$SVC_IPADDR/$SVC_NETMASK" -j ACCEPT
        iptables -A FORWARD -i "$MAGENTA_IF" -o "$SVC_IF" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
        iptables -t nat -A POSTROUTING -o "$MAGENTA_IF" -s "$SVC_IPADDR/$SVC_NETMASK" -j SNAT --to "$MAGENTA_IPADDR"

        iptables -P INPUT DROP
        iptables -P FORWARD DROP
      }

      stop() {
        iptables -P INPUT ACCEPT
        iptables -F INPUT
        iptables -P FORWARD ACCEPT
        iptables -F FORWARD
        iptables -t nat -F POSTROUTING
      }


openwrt_uci:
  system:
    - name: system
      options:
        hostname: '{{ host_name }}'
        timezone: 'CET-1CEST,M3.5.0,M10.5.0/3'
        ttylogin: '0'
        log_size: '64'
        urandom_seed: '0'

    - name: timeserver 'ntp'
      options:
        enabled: '1'
        enable_server: '0'
        server:
          - '0.at.pool.ntp.org'
          - '1.at.pool.ntp.org'
          - '2.at.pool.ntp.org'
          - '3.at.pool.ntp.org'

    - name: rngd
      options:
        enabled: '1'
        device: '/dev/hwrng'

  dropbear:
    - name: dropbear
      options:
        PasswordAuth: 'off'
        RootPasswordAuth: 'off'
        Port: '{{ ansible_port | default(22) }}'

  network:
    - name: globals 'globals'
      options:
        ula_prefix: "fc{{ '%02x:%04x:%04x' | format((255 | random(seed=inventory_hostname + '0')), (65535 | random(seed=inventory_hostname + '1')), (65535 | random(seed=inventory_hostname + '2'))) }}::/48"

    - name: interface 'loopback'
      options:
        ifname: lo
        proto: static
        ipaddr: 127.0.0.1
        netmask: 255.0.0.0

    - name: interface 'svc'
      options:
        ifname: eth0
        proto: static
        ipaddr: "{{ network_zones.svc.prefix | ipaddr(network_zones.svc.offsets[inventory_hostname]) | ipaddr('address') }}"
        netmask: "{{ network_zones.svc.prefix | ipaddr('netmask') }}"

    - name: interface 'magenta'
      options:
        ifname: eth1
        proto: static
        ipaddr: "{{ network_zones.magenta.prefix | ipaddr(network_zones.magenta.offsets[inventory_hostname]) | ipaddr('address') }}"
        netmask: "{{ network_zones.magenta.prefix | ipaddr('netmask') }}"
        gateway: "{{ network_zones.magenta.gw }}"
        dns: "{{ network_zones.magenta.dns }}"

    - name: interface 'mgmt'
      options:
        ifname: eth2
        proto: static
        ipaddr: "{{ network_zones.mgmt.prefix | ipaddr(network_zones.mgmt.offsets[inventory_hostname]) | ipaddr('address') }}"
        netmask: "{{ network_zones.mgmt.prefix | ipaddr('netmask') }}"


virsh_domxml: |
  <domain type='kvm'>
    <name>router</name>
    <memory>131072</memory>
    <currentMemory>131072</currentMemory>
    <vcpu>2</vcpu>
    <os>
      <type arch='x86_64' machine='pc-0.12'>hvm</type>
      <kernel>/srv/ch-router/vmlinuz</kernel>
      <cmdline>console=ttyS0,115200n8 noinitrd root=/dev/vda</cmdline>
      <boot dev='hd'/>
    </os>
    <features>
      <acpi/>
      <apic/>
      <pae/>
    </features>
    <clock offset='utc'/>
    <on_poweroff>destroy</on_poweroff>
    <on_reboot>restart</on_reboot>
    <on_crash>restart</on_crash>
    <devices>
      <emulator>/usr/bin/kvm</emulator>
      <rng model='virtio'>
        <!-- <rate period="2000" bytes="204800"/> -->
        <backend model='random'>/dev/random</backend>
      </rng>
      <disk type='file' device='disk'>
        <driver name='qemu' type='raw' cache='none'/>
        <source file='/srv/ch-router/rootfs-ext4.img'/>
        <target dev='sda' bus='virtio'/>
      </disk>
      <interface type='bridge'>
        <source bridge='br-svc'/>
        <model type='virtio'/>
        <address type='pci' domain='0x0000' bus='0x01' slot='0x01' function='0x0'/>
      </interface>
      <interface type='bridge'>
        <source bridge='br-magenta'/>
        <model type='virtio'/>
        <address type='pci' domain='0x0000' bus='0x01' slot='0x02' function='0x0'/>
      </interface>
      <interface type='bridge'>
        <source bridge='br-mgmt'/>
        <model type='virtio'/>
        <address type='pci' domain='0x0000' bus='0x01' slot='0x03' function='0x0'/>
      </interface>
      <console type='pty'>
        <target type='serial' port='0'/>
      </console>
    </devices>
  </domain>