---
openwrt_variant: openwrt
openwrt_release: 18.06.2
openwrt_arch: ar71xx
openwrt_target: generic
openwrt_profile: tl-wdr4300-v1
openwrt_output_image_suffixes:
  - "generic-{{ openwrt_profile }}-squashfs-sysupgrade.bin"

openwrt_packages_remove:
  - ppp
  - ppp-mod-pppoe
  - firewall
openwrt_packages_add:
  - haveged
  - htop
  - ip
  - less
  - nano
  - tcpdump-mini
  - iperf
  - mtr
  - usbutils
  - kmod-ipt-nat
  - kmod-ipt-conntrack


openwrt_mixin:
  /etc/dropbear/authorized_keys:
    content: "{{ ssh_keys_root | join('\n') }}\n"

  /etc/htoprc:
    file: "{{ global_files_dir }}/common/htoprc"

  /etc/rc.d/S22network-fw:
    link: "../init.d/network-fw"

  /etc/rc.d/K91network-fw:
    link: "../init.d/network-fw"

  /etc/init.d/network-fw:
    mode: "0755"
    content: |
      #!/bin/sh /etc/rc.common

      START=22
      STOP=91

      start() {
        LAN_IP=$(uci get network.lan.ipaddr)
        LAN_MASK=$(uci get network.lan.netmask)

        WAN_IF=$(uci get network.wan.ifname)

        iptables -A INPUT -i lo -j ACCEPT
        iptables -A INPUT -i br-lan -j ACCEPT

        iptables -A INPUT -i "$WAN_IF" -p icmp -j ACCEPT
        iptables -A INPUT -i "$WAN_IF" -p tcp --dport {{ ansible_port | default(22) }} -j ACCEPT
        iptables -A INPUT -i "$WAN_IF" -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT

        iptables -A FORWARD -i br-lan -o "$WAN_IF" -j ACCEPT
        iptables -A FORWARD -i "$WAN_IF" -o br-lan -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
        iptables -t nat -A POSTROUTING -o "$WAN_IF" -s "$LAN_IP/$LAN_MASK" -j MASQUERADE

        iptables -P INPUT DROP
        iptables -P FORWARD DROP
      }

      stop() {
        iptables -P INPUT ACCEPT
        iptables -F INPUT
        iptables -P FORWARD ACCEPT
        iptables -F FORWARD
        iptables -t nat -F POSTROUTING
      }

  /etc/dyndns/update.sh:
    mode: "0755"
    content: |
      #!/bin/sh
      /usr/bin/ssh -i /etc/dyndns/id_rsa -p 222 dyndns@dyn.schaaas.at mzl | logger -t dyndns

  /etc/crontabs/root:
    mode: "0755"
    content: |
      # run dyndns update script every 10 minutes
      */10  * * * *  /etc/dyndns/update.sh > /dev/null


openwrt_uci:
  system:
    - name: system
      options:
        hostname: '{{ host_name }}'
        timezone: 'CET-1CEST,M3.5.0,M10.5.0/3'
        ttylogin: '0'
        log_size: '64'
        urandom_seed: '0'

    - name: timeserver 'ntp'
      options:
        enabled: '1'
        enable_server: '0'
        server:
          - '0.lede.pool.ntp.org'
          - '1.lede.pool.ntp.org'
          - '2.lede.pool.ntp.org'
          - '3.lede.pool.ntp.org'

  dropbear:
    - name: dropbear
      options:
        PasswordAuth: 'off'
        RootPasswordAuth: 'off'
        Port: '{{ ansible_port | default(22) }}'

  network:
    - name: globals 'globals'
      options:
        ula_prefix: "fc{{ '%02x:%04x:%04x' | format((255 | random(seed=inventory_hostname + '0')), (65535 | random(seed=inventory_hostname + '1')), (65535 | random(seed=inventory_hostname + '2'))) }}::/48"

    - name: interface 'loopback'
      options:
        ifname: lo
        proto: static
        ipaddr: 127.0.0.1
        netmask: 255.0.0.0

    - name: switch
      options:
        name: switch0
        reset: 1
        enable_vlan: 1

    - name: switch_vlan
      options:
        device: switch0
        vlan: 1
        ports: 2 3 4 5 0t

    - name: switch_vlan
      options:
        device: switch0
        vlan: 2
        ports: 1 0t

    - name: interface 'lan'
      options:
        ifname: eth0.1
        force_link: 1
        type: bridge
        proto: static
        ipaddr: 192.168.2.254
        netmask: 255.255.255.0

    - name: interface 'wan'
      options:
        ifname: eth0.2
        proto: dhcp

  wireless:
    - name: wifi-device 'radio5g'
      options:
        type: mac80211
        path: "pci0000:00/0000:00:00.0"
        hwmode: 11a
        htmode: HT20
        country: AT
        txpower: 19

    - name: wifi-device 'radio2g4'
      options:
        type: mac80211
        path: "platform/ar934x_wmac"
        hwmode: 11g
        htmode: HT20
        channel: 4
        country: AT
        txpower: 20

    - name: wifi-iface wds5g
      options:
        device: radio5g
        network: lan
        mode: ap
        wds: 1
        disassoc_low_ack: 1
        rsn_preauth: 1
        ssid: "chaosWDS"
        encryption: 'psk2+ccmp'
        key: '{{ vault_wifi_keys.wds_mz }}'

    - name: wifi-iface lan5g
      options:
        device: radio5g
        network: lan
        mode: ap
        disassoc_low_ack: 1
        rsn_preauth: 1
        ssid: "chaos at home"
        encryption: 'psk2+ccmp'
        key: '{{ vault_wifi_keys.lan }}'

    - name: wifi-iface lan2g4
      options:
        device: radio2g4
        network: lan
        mode: ap
        disassoc_low_ack: 1
        rsn_preauth: 1
        ssid: "chaos at home"
        encryption: 'psk2+ccmp'
        key: '{{ vault_wifi_keys.lan }}'