---
openwrt_arch: ath79
openwrt_target: generic
openwrt_profile: tplink_tl-wdr3500-v1
openwrt_output_image_suffixes:
  - "{{ openwrt_target }}-{{ openwrt_profile }}-squashfs-sysupgrade.bin"

openwrt_packages_remove:
  - ppp
  - ppp-mod-pppoe
  - dnsmasq
  - firewall
  - firewall4
  - odhcpd
  - odhcpd-ipv6only
  - wpad-basic-wolfssl
openwrt_packages_add:
  - wpad-wolfssl
  - haveged
  - htop
  - ip
  - less
  - nano
  - tcpdump-mini
  - iperf
  - mtr
  - usbutils
  - kmod-usb-printer
  - p910nd


openwrt_mixin:
  /etc/sysctl.conf:
    content: |
      # Defaults are configured in /etc/sysctl.d/* and can be customized in this file
      #
      # disable IP forwarding, we don't need it since we are
      # only an AP that bridges VLANs to Wifi SSIDs
      net.ipv4.conf.default.forwarding=0
      net.ipv4.conf.all.forwarding=0
      net.ipv4.ip_forward=0
      net.ipv6.conf.default.forwarding=0
      net.ipv6.conf.all.forwarding=0

  /etc/dropbear/authorized_keys:
    content: "{{ ssh_keys_root | join('\n') }}\n"

  /etc/htoprc:
    file: "{{ global_files_dir }}/common/htoprc"

  /usr/bin/list-stations:
    mode: "0755"
    file: "{{ global_files_dir }}/common/openwrt/list-stations"


openwrt_uci:
  system:
    - name: system
      options:
        hostname: '{{ host_name }}'
        timezone: 'CET-1CEST,M3.5.0,M10.5.0/3'
        ttylogin: '0'
        log_size: '64'
        urandom_seed: '0'

    - name: timeserver 'ntp'
      options:
        enabled: '1'
        enable_server: '0'
        server:
          - '192.168.2.254'

  dropbear:
    - name: dropbear
      options:
        PasswordAuth: 'off'
        RootPasswordAuth: 'off'
        Port: '{{ ansible_port }}'

  p910nd:
    - name: p910nd
      options:
        device: /dev/usb/lp0
        port: 0
        bidirectional: 1
        enabled: 1

  network:
    - name: globals 'globals'
      options:
        ula_prefix: "fc{{ '%02x:%04x:%04x' | format((255 | random(seed=inventory_hostname + '0')), (65535 | random(seed=inventory_hostname + '1')), (65535 | random(seed=inventory_hostname + '2'))) }}::/48"

    - name: interface 'loopback'
      options:
        device: lo
        proto: static
        ipaddr: 127.0.0.1
        netmask: 255.0.0.0

    - name: switch
      options:
        name: switch0
        reset: 1
        enable_vlan: 1

    - name: switch_vlan
      options:
        device: switch0
        vlan: 1
        ports: 1 2 3 4 0t

    - name: device
      options:
        name: br-lan
        type: bridge
        ports:
        - eth0.1

    - name: interface 'lan'
      options:
        device: br-lan
        proto: static
        ipaddr: 192.168.2.201
        netmask: 255.255.255.0
        gateway: 192.168.2.254
        dns:
        - 192.168.2.254

    - name: interface 'wan'
      options:
        ifname: eth1
        proto: none

  wireless:
    - name: wifi-device 'radio5g'
      options:
        type: mac80211
        band: 5g
        country: AT
        path: "pci0000:00/0000:00:00.0"
        htmode: HT20
        txpower: 19

    - name: wifi-device 'radio2g'
      options:
        type: mac80211
        channel: 5
        band: 2g
        country: AT
        path: "platform/ahb/18100000.wmac"
        htmode: HT20
        cell_density: 0
        txpower: 20

    - name: wifi-iface wds5g
      options:
        device: radio5g
        network: lan
        mode: sta
        wds: 1
        ssid: "chaosWDS"
        encryption: 'sae-mixed'
        key: '{{ vault_wifi_keys.wds_mz }}'

    - name: wifi-iface lan2g
      options:
        device: radio2g
        network: lan
        mode: ap
        disassoc_low_ack: 1
        rsn_preauth: 1
        ssid: "chaos at home"
        encryption: 'sae-mixed'
        key: '{{ vault_wifi_keys.lan }}'
        ieee80211r: '1'
        mobility_domain: 'ca00'
        ft_over_ds: '1'

    - name: wifi-iface lan2gl
      options:
        device: radio2g
        network: lan
        mode: ap
        disassoc_low_ack: 1
        rsn_preauth: 1
        ssid: "chaos at home (legacy)"
        encryption: 'psk2'
        key: '{{ vault_wifi_keys.lan }}'
        ieee80211r: '1'
        mobility_domain: 'ca01'
        ft_over_ds: '1'