#SPDX-License-Identifier: MIT-0
---
# --- Connection ---
# opnsense_firewall defaults to ansible_host from inventory
opnsense_firewall: "{{ ansible_host }}"
opnsense_api_key: ""       # set in Ansible Vault
opnsense_api_secret: ""    # set in Ansible Vault
opnsense_ssl_verify: true
opnsense_api_port: 443

# --- System settings ---
opnsense_hostname: opnsense
opnsense_domain: homelan
opnsense_timezone: Europe/Vienna
opnsense_dns_servers:
  - 1.1.1.1
  - 8.8.8.8

# --- Gateways ---
# opnsense_gateways:
#   - name: WAN_GW
#     interface: wan
#     gateway: 192.168.1.1
#     ip_protocol: inet
#     default_gw: true
opnsense_gateways: []

# --- VLANs ---
# opnsense_vlans:
#   - interface: vtnet0
#     tag: 10
#     description: LAN
opnsense_vlans: []

# --- Network topology ---
# OPNsense interface names as assigned in WebUI (Interfaces → Assignments)
opnsense_lan_interface: lan
opnsense_dmz_interface: opt1
opnsense_guest_interface: opt2
opnsense_iot_interface: opt3

# OPNsense's own IP address — used as DNS target in firewall rules
# Set this to OPNsense's LAN IP (e.g. 192.168.1.1)
opnsense_self_address: ""

# IoT hosts allowed internet access — list of IPs for iot_internet_allowed alias
opnsense_iot_internet_allowed: []

# --- Firewall aliases ---
# opnsense_aliases:
#   - name: rfc1918
#     type: network
#     content:
#       - 10.0.0.0/8
#       - 172.16.0.0/12
#       - 192.168.0.0/16
#     description: Private networks
opnsense_aliases: []

# --- Firewall rules ---
# opnsense_rules:
#   - description: Allow LAN to internet
#     interface: [lan]
#     direction: in
#     action: pass
#     source_net: lan
#     destination_net: any
#     protocol: any
#     enabled: true
opnsense_rules: []

# --- NAT (outbound / masquerade) ---
# opnsense_nat_source_rules:
#   - description: Masquerade LAN to WAN
#     interface: wan
#     source_net: 192.168.0.0/24
#     target: interface
#     enabled: true
opnsense_nat_source_rules: []

# --- DHCP server ---
opnsense_dhcp_enabled: false
opnsense_dhcp_interfaces: []
opnsense_dhcp_fw_rules: false

# opnsense_dhcp_subnets:
#   - subnet: 192.168.1.0/24
#     pools:
#       - 192.168.1.100 - 192.168.1.200
#     gateway: [192.168.1.1]
#     dns: [192.168.1.1]
#     domain: homelan
#     description: LAN
opnsense_dhcp_subnets: []

# opnsense_dhcp_reservations:
#   - ip: 192.168.1.10
#     mac: "aa:bb:cc:dd:ee:ff"
#     hostname: myhost
#     subnet: 192.168.1.0/24
#     description: My host
opnsense_dhcp_reservations: []

# --- Unbound DNS resolver ---
opnsense_unbound_enabled: true
opnsense_unbound_port: 53
opnsense_unbound_dnssec: true
opnsense_unbound_register_dhcp_leases: false
opnsense_unbound_register_dhcp_static_mappings: false
opnsense_unbound_register_system_records: true

# Host overrides — aliases are sub-properties of each host entry.
# alias.domain defaults to the parent host's domain if not set.
# alias.target is auto-set to hostname.domain of the parent host.
# opnsense_unbound_hosts:
#   - hostname: vhost0
#     domain: homelan
#     records:
#       - value: 10.61.0.100          # type defaults to A
#       - type: AAAA
#         value: "fd30:882:6101:1::1"
#     aliases:
#       - alias: web
#       - alias: api
#   - hostname: vhost1
#     domain: homelan
#     records:
#       - value: 10.61.0.110
opnsense_unbound_hosts: []

# Selective forwards — leave empty to resolve everything from root servers
# opnsense_unbound_forwards:
#   - domain: homelan
#     target: 10.61.0.1
#     description: Local domain
#   - domain: internal.example.com
#     target: 192.168.1.53
#     description: Internal DNS
opnsense_unbound_forwards: []

# --- OpenVPN clients ---
opnsense_openvpn_static_keys: []
opnsense_openvpn_clients: []

# --- WireGuard ---
opnsense_wireguard_enabled: true

# opnsense_wireguard_servers:
#   - name: wg0
#     private_key: "{{ vault_wg_private_key }}"
#     port: 51820
#     allowed_ips:
#       - 10.0.0.1/24
#     peers: []
#     enabled: true
opnsense_wireguard_servers: []

# opnsense_wireguard_peers:
#   - name: client1
#     public_key: "CLIENT_PUBLIC_KEY"
#     allowed_ips:
#       - 10.0.0.2/32
#     servers: [wg0]
#     keepalive: 25
#     enabled: true
opnsense_wireguard_peers: []