# Site gateway Chiang Mai (site 1): Topton 1U, Intel N300, 4x i226-V 2.5G.
# The router itself (ports, VLANs, features) is the `router` service instance
# in clan.nix; only machine-local bits live here.
{ config, lib, ... }:
{
  imports = [ ../../modules/monitoring/exporters.nix ];

  clan.core.sops.defaultGroups = [ "admins" ];

  # Until the install generates facter.json (which normally provides this).
  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";

  # ZFS (disko.nix) needs a stable machine-unique hostId; derive it from the
  # hostname so every gateway gets one for free when copied for a new site.
  networking.hostId = builtins.substring 0 8 (
    builtins.hashString "sha256" config.networking.hostName
  );

  # STAGING (remove at cutover, and restore enp3s0 to trunkPorts in clan.nix):
  # DHCP-client uplink into the existing OPNsense LAN so the box has internet +
  # mesh while it runs alongside the old router. Default-deny firewall on this
  # interface (it's in no VLAN zone); PPPoE simply retries until the WAN port
  # is cabled. Do NOT connect the trunk ports to the production switch while
  # staging — Kea on tag 10 would fight the OPNsense LAN DHCP in one broadcast
  # domain.
  systemd.network.networks."05-staging" = {
    matchConfig.Name = "enp3s0";
    networkConfig.DHCP = "ipv4";
  };

  time.timeZone = "Etc/GMT-7"; # UTC+7 (Thailand, fixed offset, no DST)
  services.chrony.enable = true;
}