# iperf3 server on every gateway, for throughput testing from any LAN segment
# (e.g. validating AP/switch links: `iperf3 -c 10.<siteId>.<vlan>.1`) and from
# admin machines over the mesh. Never reachable from the WAN (default-deny).
{
  config,
  lib,
  ...
}:
let
  cfg = config.cnx.router;
  mesh = import ../mesh-hosts.nix { inherit config lib; };
  vlanIfs = lib.mapAttrsToList (name: _: "vlan-${name}") cfg.vlans;
in
{
  config = lib.mkIf cfg.enable {
    services.iperf3.enable = true;

    networking.firewall.interfaces = lib.genAttrs vlanIfs (_: {
      allowedTCPPorts = [ 5201 ];
      allowedUDPPorts = [ 5201 ];
    });

    networking.firewall.extraInputRules = ''
      ip6 saddr ${mesh.subnet} tcp dport 5201 accept comment "iperf3 over the mesh"
      ip6 saddr ${mesh.subnet} udp dport 5201 accept comment "iperf3 over the mesh"
    '';
  };
}