{# Desired VyOS config as `set` lines. vyos_config diffs these against the
   running config, so only differences are applied. Written for VyOS 2025.11
   syntax explicitly -- see defaults/main.yml for why we do not use the
   collection's resource modules. #}
set system host-name {{ vyos_router_hostname }}
set system name-server {{ vyos_nameserver }}

{# --- LAN leg: OSPF peer with the NEC IX --- #}
set interfaces ethernet {{ vyos_lan_interface }} address {{ vyos_lan_address }}
set interfaces ethernet {{ vyos_lan_interface }} description 'LAN / OSPF to NEC IX'

{# --- SDN legs: gateways for the PVE VNets --- #}
{% for i in vyos_sdn_interfaces %}
set interfaces ethernet {{ i.iface }} address {{ i.address }}
set interfaces ethernet {{ i.iface }} description '{{ i.description }}'
{% endfor %}

{# OpenSandbox stays on a NodePort; VyOS owns the stable routed frontend. #}
set load-balancing haproxy service opensandbox-api listen-address {{ vyos_sandbox_k3s_api_address }}
set load-balancing haproxy service opensandbox-api port {{ vyos_opensandbox_api_port }}
set load-balancing haproxy service opensandbox-api mode 'tcp'
set load-balancing haproxy service opensandbox-api backend 'opensandbox-api'
set load-balancing haproxy backend opensandbox-api mode 'tcp'
{% for server in vyos_sandbox_k3s_servers %}
set load-balancing haproxy backend opensandbox-api server {{ server.name }} address {{ server.address }}
set load-balancing haproxy backend opensandbox-api server {{ server.name }} port {{ vyos_opensandbox_node_port }}
set load-balancing haproxy backend opensandbox-api server {{ server.name }} check
{% endfor %}

{# --- default route out; OSPF carries the rest --- #}
set protocols static route 0.0.0.0/0 next-hop {{ vyos_lan_gateway }}

{# --- OSPF: intra-area, NOT redistribute connected --- #}
set protocols ospf parameters router-id {{ vyos_ospf_router_id }}
{% for n in vyos_ospf_networks %}
set protocols ospf area {{ vyos_ospf_area }} network {{ n }}
{% endfor %}
{% for i in vyos_sdn_interfaces %}
set protocols ospf area {{ vyos_ospf_area }} network {{ i.network }}
{# passive: advertise the subnet, but never try to peer with guests on it #}
set protocols ospf interface {{ i.iface }} passive
{% endfor %}

{# --- K3s PostgreSQL datastore: fixed endpoint, explicitly selected primary --- #}
set load-balancing haproxy service sandbox-postgresql listen-address {{ vyos_postgresql_listen_address }}
set load-balancing haproxy service sandbox-postgresql port {{ vyos_postgresql_port }}
set load-balancing haproxy service sandbox-postgresql mode 'tcp'
set load-balancing haproxy service sandbox-postgresql backend 'sandbox-postgresql-primary'
set load-balancing haproxy backend sandbox-postgresql-primary mode 'tcp'
set load-balancing haproxy backend sandbox-postgresql-primary server primary address {{ vyos_postgresql_primary_address }}
set load-balancing haproxy backend sandbox-postgresql-primary server primary port {{ vyos_postgresql_port }}
set load-balancing haproxy backend sandbox-postgresql-primary server primary check

{# --- Sandbox K3s API: stable address with both control-plane nodes --- #}
set interfaces ethernet {{ vyos_sandbox_k3s_api_interface }} address '{{ vyos_sandbox_k3s_api_address }}/32'
set load-balancing haproxy service sandbox-k3s-api listen-address {{ vyos_sandbox_k3s_api_address }}
set load-balancing haproxy service sandbox-k3s-api port {{ vyos_sandbox_k3s_api_port }}
set load-balancing haproxy service sandbox-k3s-api mode 'tcp'
set load-balancing haproxy service sandbox-k3s-api backend 'sandbox-k3s-api'
set load-balancing haproxy backend sandbox-k3s-api mode 'tcp'
{% for server in vyos_sandbox_k3s_servers %}
set load-balancing haproxy backend sandbox-k3s-api server {{ server.name }} address {{ server.address }}
set load-balancing haproxy backend sandbox-k3s-api server {{ server.name }} port {{ vyos_sandbox_k3s_api_port }}
set load-balancing haproxy backend sandbox-k3s-api server {{ server.name }} check
{% endfor %}

{# --- management --- #}
set service ssh port 22

{# --- DHCP for the SDN VNets --- #}
{% for i in vyos_sdn_interfaces if i.dhcp is defined %}
set service dhcp-server shared-network-name {{ i.vnet | upper }} subnet {{ i.network }} subnet-id {{ i.dhcp.subnet_id }}
set service dhcp-server shared-network-name {{ i.vnet | upper }} subnet {{ i.network }} option default-router {{ i.address.split('/')[0] }}
set service dhcp-server shared-network-name {{ i.vnet | upper }} subnet {{ i.network }} option name-server {{ vyos_dhcp_nameserver }}
set service dhcp-server shared-network-name {{ i.vnet | upper }} subnet {{ i.network }} option domain-name {{ i.dhcp.domain }}
{% if i.dhcp.wins is defined %}
set service dhcp-server shared-network-name {{ i.vnet | upper }} subnet {{ i.network }} option wins-server {{ i.dhcp.wins }}
{% endif %}
set service dhcp-server shared-network-name {{ i.vnet | upper }} subnet {{ i.network }} range 0 start {{ i.dhcp.start }}
set service dhcp-server shared-network-name {{ i.vnet | upper }} subnet {{ i.network }} range 0 stop {{ i.dhcp.stop }}
{% for r in i.dhcp.reservations | default([]) %}
set service dhcp-server shared-network-name {{ i.vnet | upper }} subnet {{ i.network }} static-mapping {{ r.name }} mac {{ r.mac }}
set service dhcp-server shared-network-name {{ i.vnet | upper }} subnet {{ i.network }} static-mapping {{ r.name }} ip-address {{ r.address }}
{% endfor %}
{% endfor %}