# iperf3 server on every gateway, for throughput testing from any LAN segment
# (e.g. validating AP/switch links: `iperf3 -c 10.<siteId>.<vlan>.1`) and from
# admin machines over the mesh. Never reachable from the WAN (default-deny).
{ settings }:
{ lib, ... }:
let
  cfg = settings;
  vlanIfs = lib.mapAttrsToList (name: _: "vlan-${name}") cfg.vlans;
in
{
  services.iperf3.enable = true;

  networking.firewall.interfaces = lib.genAttrs vlanIfs (_: {
    allowedTCPPorts = [ 5201 ];
    allowedUDPPorts = [ 5201 ];
  });

  networking.firewall.extraInputRules = ''
    ip6 saddr ${cfg.mesh.subnet} tcp dport 5201 accept comment "iperf3 over the mesh"
    ip6 saddr ${cfg.mesh.subnet} udp dport 5201 accept comment "iperf3 over the mesh"
  '';
}