---
## TOOD:
# After router upgrades run this command to generate a new dyndns ssh key
#   $ dropbearkey -t ed25519 -f /etc/dyndns/id_ed25519
# Then replace the key at the dyndns server (/var/lib/dyndns/.ssh/authorized_keys)
# after that run the dyndns update script manually to accept the ssh host-key

openwrt_arch: ath79
openwrt_target: generic
openwrt_profile: tplink_tl-wdr4300-v1
openwrt_output_image_suffixes:
  - "{{ openwrt_target }}-{{ openwrt_profile }}-squashfs-sysupgrade.bin"

openwrt_packages_remove:
  - ppp
  - ppp-mod-pppoe
  - firewall
  - firewall4
  - wpad-basic-mbedtls
openwrt_packages_add:
  - hostapd-mbedtls
  - haveged
  - htop
  - ip
  - less
  - nano
  - tcpdump-mini
  - iperf
  - mtr
  - usbutils
  - nftables
  - kmod-nft-nat


openwrt_mixin:
  /etc/dropbear/authorized_keys:
    content: "{{ ssh_keys_root | join('\n') }}\n"

  /etc/htoprc:
    file: "{{ global_files_dir }}/common/htoprc"

  /usr/bin/list-stations:
    mode: "0755"
    file: "{{ global_files_dir }}/common/openwrt/list-stations"

  /etc/rc.d/S21nftables:
    link: "../init.d/nftables"

  /etc/rc.d/K89nftables:
    link: "../init.d/nftables"

  /etc/init.d/nftables:
    mode: "0755"
    content: |
      #!/bin/sh /etc/rc.common

      START=21
      STOP=89

      start() {
        nft -f /etc/nftables.conf
      }

      stop() {
        nft flush ruleset
      }

  /etc/nftables.conf:
    content: |
      flush ruleset

      define nic_wan = eth0.2
      define nic_lan = br-lan
      define prefix_lan = 192.168.2.0/24

      table inet global {
        ## INPUT
        chain input_wan {
          ip protocol icmp accept
          ip6 nexthdr ipv6-icmp accept
          tcp dport { {{ ansible_port }} } accept
        }

        chain input {
          type filter hook input priority filter; policy drop;
          ct state vmap { established: accept, related: accept, invalid: drop }
          iifname vmap { lo: accept, $nic_lan: accept, $nic_wan: jump input_wan }
        }


        ## FORWARD
        chain forward {
          type filter hook forward priority filter; policy drop;
          ct state vmap { established: accept, related: accept, invalid: drop }
          iifname $nic_lan ip saddr $prefix_lan oifname $nic_wan accept
        }

        chain postrouting {
          type nat hook postrouting priority srcnat; policy accept;
          ip saddr $prefix_lan oifname $nic_wan masquerade
        }
      }

  /etc/dyndns/update.sh:
    mode: "0755"
    content: |
      #!/bin/sh
      /usr/bin/ssh -i /etc/dyndns/id_ed25519 -p 222 dyndns@dyn.schaaas.at mzl | logger -t dyndns

  /etc/crontabs/root:
    mode: "0755"
    content: |
      # run dyndns update script every 10 minutes
      */10  * * * *  /etc/dyndns/update.sh > /dev/null


openwrt_uci:
  system:
    - name: system
      options:
        hostname: '{{ host_name }}'
        timezone: 'CET-1CEST,M3.5.0,M10.5.0/3'
        ttylogin: '0'
        log_size: '64'
        urandom_seed: '0'

    - name: timeserver 'ntp'
      options:
        enabled: '1'
        enable_server: '1'
        server:
          - '0.at.pool.ntp.org'
          - '1.at.pool.ntp.org'
          - '2.at.pool.ntp.org'
          - '3.at.pool.ntp.org'

  dropbear:
    - name: dropbear
      options:
        PasswordAuth: 'off'
        RootPasswordAuth: 'off'
        Port: '{{ ansible_port }}'

  network:
    - name: globals 'globals'
      options:
        ula_prefix: "fc{{ '%02x:%04x:%04x' | format((255 | random(seed=inventory_hostname + '0')), (65535 | random(seed=inventory_hostname + '1')), (65535 | random(seed=inventory_hostname + '2'))) }}::/48"

    - name: interface 'loopback'
      options:
        device: lo
        proto: static
        ipaddr: 127.0.0.1
        netmask: 255.0.0.0

    - name: switch
      options:
        name: switch0
        reset: 1
        enable_vlan: 1

    - name: switch_vlan
      options:
        device: switch0
        vlan: 1
        ports: 2 3 4 5 0t

    - name: switch_vlan
      options:
        device: switch0
        vlan: 2
        ports: 1 0t

    - name: device
      options:
        name: br-lan
        type: bridge
        ports:
        - eth0.1

    - name: interface 'lan'
      options:
        device: br-lan
        proto: static
        ipaddr: 192.168.2.254
        netmask: 255.255.255.0

    - name: interface 'wan'
      options:
        ifname: eth0.2
        proto: dhcp

  wireless:
    - name: wifi-device 'radio5g'
      options:
        type: mac80211
        channel: 40
        band: 5g
        country: AT
        path: "pci0000:00/0000:00:00.0"
        htmode: HT20
        cell_density: 0
        txpower: 19

    - name: wifi-device 'radio2g'
      options:
        type: mac80211
        channel: 11
        band: 2g
        country: AT
        path: "platform/ahb/18100000.wmac"
        htmode: HT20
        cell_density: 0
        txpower: 20

    - name: wifi-iface wds5g
      options:
        device: radio5g
        network: lan
        mode: ap
        wds: 1
        disassoc_low_ack: 1
        rsn_preauth: 1
        ssid: "chaosWDS"
        encryption: 'sae-mixed'
        key: '{{ vault_wifi_keys.wds_mz }}'

    - name: wifi-iface lan5g
      options:
        device: radio5g
        network: lan
        mode: ap
        disassoc_low_ack: 1
        rsn_preauth: 1
        ssid: "chaos at home"
        encryption: 'sae-mixed'
        key: '{{ vault_wifi_keys.lan }}'
        ieee80211r: '1'
        mobility_domain: 'ca00'
        ft_over_ds: '1'

    - name: wifi-iface lan5gl
      options:
        device: radio5g
        network: lan
        mode: ap
        disassoc_low_ack: 1
        rsn_preauth: 1
        ssid: "chaos at home"
        encryption: 'psk2'
        key: '{{ vault_wifi_keys.lan }}'
        ieee80211r: '1'
        mobility_domain: 'ca01'
        ft_over_ds: '1'

    - name: wifi-iface lan2g
      options:
        device: radio2g
        network: lan
        mode: ap
        disassoc_low_ack: 1
        rsn_preauth: 1
        ssid: "chaos at home"
        encryption: 'sae-mixed'
        key: '{{ vault_wifi_keys.lan }}'
        ieee80211r: '1'
        mobility_domain: 'ca00'
        ft_over_ds: '1'

    - name: wifi-iface lan2gl
      options:
        device: radio2g
        network: lan
        mode: ap
        disassoc_low_ack: 1
        rsn_preauth: 1
        ssid: "chaos at home (legacy)"
        encryption: 'psk2'
        key: '{{ vault_wifi_keys.lan }}'
        ieee80211r: '1'
        mobility_domain: 'ca01'
        ft_over_ds: '1'