# Site gateways: the `router` clan service from cnx-network-clan (see
# flake.nix input `cnx-network`, and that repo's modules/clan/router/README.md).
# One instance for the fleet; each site adds its gateway machine with the
# site's port / VLAN layout. `clan vars generate <gw>` then prompts for the
# PPPoE username/password.
{ lib, ... }:
let
  # Admin mesh = the site's ZeroTier network. The service only opens SSH,
  # metrics and iperf3 to this prefix, so the gateway must also be a peer of
  # the same network (tag membership in default.nix). Prefix derivation as in
  # cnx-network's modules/mesh-hosts.nix: fd + 8-byte network id + 0x9993,
  # /88 covers every peer.
  meshSubnet =
    instance:
    let
      networkId = lib.fileContents ../vars/shared/zerotier-network-${instance}/network-id/value;
      full = "fd" + networkId + "9993";
      hextet = i: builtins.substring (i * 4) 4 full;
    in
    "${hextet 0}:${hextet 1}:${hextet 2}:${hextet 3}:${hextet 4}:${builtins.substring 20 2 full}00::/88";
in
{
  clan.inventory.instances.router = {
    module = {
      name = "router";
      input = "cnx-network";
    };

    roles.default.settings.mesh.subnet = meshSubnet "w-network";

    # stellio: GL.iNet Flint 2 (GL-MT6000, MT7986a). Ports as named by the
    # device tree in matthew-hardware: eth1 = the 2.5G "WAN" port, lan1 = the
    # 2.5G LAN port, lan2-lan5 = the 1G LAN ports (DSA on the MT7531 switch).
    roles.default.machines.stellio.settings = {
      site = "white-house";
      siteId = 8;

      # PPPoE on the ISP's VLAN 10, as on the liminix router it replaces
      # (routers/white-house); set to null if the ISP runs PPPoE untagged.
      wan.interface = "end1";
      wan.vlanId = 10;

      # lan1 (2.5G): untagged mgmt port for on-site recovery. lan2-lan4 (1G):
      # untagged client ports on lan. lan5 is the pre-cutover staging uplink:
      # DHCP client into the old LAN (routers/white-house), SSH only, no VLAN
      # membership; set stagingPort = null at cutover.
      accessPorts = {
        lan1 = "mgmt";
        lan2 = "lan";
        lan3 = "lan";
        lan4 = "lan";
      };
      stagingPort = "lan5";

      # Both MT7976 radios broadcast the site SSID (same name and passphrase
      # as the liminix router's "WhiteHouse"/"WhiteHouse-5", merged into one
      # dual-band SSID) as an untagged access port on lan. Passphrase is the
      # `wifi-WhiteHouse-passphrase` vars prompt. Channels as on the old
      # router. Check the band mapping with `iw phy` (mt7986: phy0/wlan0 =
      # 2.4 GHz, phy1/wlan1 = 5 GHz).
      wifi = {
        enable = true;
        countryCode = "TH";
        networks.WhiteHouse.vlan = "lan";
        radios = {
          wlan0 = {
            band = "2g";
            channel = 2;
            wifi6 = true;
            networks = [ "WhiteHouse" ];
          };
          wlan1 = {
            band = "5g";
            channel = 36;
            wifi6 = true;
            networks = [ "WhiteHouse" ];
          };
        };
      };

      # 10.1.<id>.0/24, router .1, DHCP pool .100-.199.
      vlans = {
        mgmt.id = 10;
        lan.id = 20;
      };
    };
  };
}