# Site gateway Chiang Mai (site 1): Topton 1U, Intel N300, 4x i226-V 2.5G.
# Port roles below use the expected igc names — verify against facter.json
# after the first install and adjust if the box enumerates differently.
{ config, lib, ... }:
{
  imports = [
    ../../modules/router
    ../../modules/monitoring/exporters.nix
    (import ../../modules/dns/acme-gw-secret.nix "gw-cnx-1")
  ];

  clan.core.sops.defaultGroups = [ "admins" ];

  # Until the install generates facter.json (which normally provides this).
  nixpkgs.hostPlatform = lib.mkDefault "x86_64-linux";

  # ZFS (disko.nix) needs a stable machine-unique hostId; derive it from the
  # hostname so every gateway gets one for free when copied for a new site.
  networking.hostId = builtins.substring 0 8 (
    builtins.hashString "sha256" config.networking.hostName
  );

  cnx.router = {
    enable = true;
    site = "cnx";
    siteId = 1;
    wan.interface = "enp1s0";
    wan.vlanId = 10; # AIS delivers PPPoE tagged on VLAN 10
    trunkPorts = [
      "enp2s0"
      "enp3s0"
      "enp4s0"
    ];
    vlans = {
      mgmt.id = 10; # 10.1.10.0/24 — APs, switches, Omada, admin
      lan.id = 20; # 10.1.20.0/24 — trusted clients
    };
    # This site runs the Omada controller for its APs/switches.
    omada.enable = true;

    # Internal reverse proxy: real wildcard cert *.cnx1.cnx.network; Blocky
    # resolves the names to the router's LAN address for mgmt+lan clients.
    proxy = {
      enable = true;
      services.omada = {
        # Omada's UI is HTTPS with a self-signed cert on the host network.
        backend = "https://127.0.0.1:8043";
        insecureSkipVerify = true;
      };
    };
  };

  time.timeZone = "Etc/GMT-7"; # UTC+7 (Thailand, fixed offset, no DST)
  services.chrony.enable = true;
}