---
openwrt_arch: x86
openwrt_target: geode
openwrt_output_image_suffixes:
  - combined-ext4.img.gz
  - combined-squashfs.img

openwrt_packages_extra:
  - "-dropbear"
  - hwclock
  - flashrom
  - git
  - kmod-usb-acm
  - openssh-server
  - openssh-sftp-server
  - screen
  - sudo
  - usbutils

openwrt_mixin:
  # Go binaries
  /usr/local/bin/door_client:
    mode: '0755'
    file: "{{ global_cache_dir }}/{{ inventory_hostname }}/door_and_sensors/door_client/door_client"
  /usr/local/bin/door_daemon:
    mode: '0755'
    file: "{{ global_cache_dir }}/{{ inventory_hostname }}/door_and_sensors/door_daemon/door_daemon"
  /usr/local/bin/update-keys:
    mode: '0755'
    file: "{{ global_cache_dir }}/{{ inventory_hostname }}/door_and_sensors/update-keys/update-keys"

  /usr/local/bin/authorized_keys.sh:
    mode: '0755'
    file: "{{ global_artifacts_dir }}/{{ inventory_hostname }}/authorized_keys.sh"

  /usr/local/bin/update-keys-from-stdin.sh:
    mode: '0755'
    file: "{{ global_artifacts_dir }}/{{ inventory_hostname }}/update-keys-from-stdin.sh"

  /etc/ssh/sshd_config:
    content: |
      Port 22000

      AllowUsers root tuerctl tuergit
      AuthenticationMethods publickey
      AuthorizedKeysFile /etc/ssh/authorized_keys.d/%u

      AllowAgentForwarding no
      AllowTcpForwarding no
      X11Forwarding no
      UsePrivilegeSeparation sandbox

      Subsystem sftp /usr/libexec/sftp-server

      Match User tuerctl
        AuthorizedKeysFile /dev/null
        AuthorizedKeysCommand /usr/local/bin/authorized_keys.sh
        AuthorizedKeysCommandUser tuergit

  /etc/ssh/authorized_keys.d/root:
    content: |-
      {% for key in noc_ssh_keys %}
      {{ key }}
      {% endfor %}

  /etc/ssh/authorized_keys.d/tuergit:
    content: |-
      {% for key in noc_ssh_keys %}
      {{ key }}
      {% endfor %}

openwrt_uci:
  system:
    - name: system
      options:
        hostname: '{{ inventory_hostname }}'
        timezone: 'CET-1CEST,M3.5.0,M10.5.0/3'
        ttylogin: '0'
        log_size: '64'
        urandom_seed: '0'

    - name: timeserver 'ntp'
      options:
        enabled: '1'
        enable_server: '0'
        server:
          - '0.lede.pool.ntp.org'
          - '1.lede.pool.ntp.org'
          - '2.lede.pool.ntp.org'
          - '3.lede.pool.ntp.org'

  network:
    - name: globals 'globals'
      options:
        ula_prefix: fdc9:e01f:83db::/48

    - name: interface 'loopback'
      options:
        ifname: lo
        proto: static
        ipaddr: 127.0.0.1
        netmask: 255.0.0.0

    - name: interface 'mgmt'
      options:
        ifname: eth0
        accept_ra: 0
        proto: static
        ipaddr: "{{ net.mgmt.prefix | ipaddr(100) | ipaddr('address') }}"
        netmask: "{{ net.mgmt.prefix | ipaddr('netmask') }}"
        gateway: "{{ net.mgmt.gw }}"
        dns: "{{ net.mgmt.dns | join(' ') }}"
        dns_search: realraum.at


openwrt_mounts:
  - path: /run
    src: none
    fstype: tmpfs
    opts: nosuid,nodev,noexec,noatime

openwrt_users:
  tuerd: {}
  tuergit:
    home:  /home/tuergit
    shell: /usr/bin/git-shell
  tuerctl:
    shell: /bin/false # TODO fixme