TP15: CRS326-Core als L3-Router aktiviert

- crs326-core nimmt Routing/DHCP/DNS/NAT/WAN/WireGuard von ap1 ueber.
- L2-Portplan korrigiert (ap1 #15, Arris WAN #16, branch #8, Sonos #2/3/5/6,
  IoT #14, VLAN10-Access #11, VLAN1-Hybrid #3/7/9/10/12/17-24).
- Backup-RSC gefixt (ether3-24 disabled) und via fixed-RSC eingespielt.
- Gestagede L3-Config enabled in einem Rutsch.
- Falsche statische Default-Route 0.0.0.0/0 -> 10.40.41.1 entfernt,
  WAN-DHCP via 90.146.33.177/24 aktiv.
- SFP-Ports bleiben disabled (Stromersparnis).
- ap1 ist L3-stillgelegt und wird in naechster Session reiner AP.

Backup-Dateien (*.backup) und leases-export.json bleiben lokal.

Co-Authored-By: Claude <noreply@anthropic.com>

routeros/push-gc-template.py

@@ -0,0 +1,59 @@
+#!/usr/bin/env python3
+"""Push nautobot/mikrotik_routeros.j2 to the bf-golden-config Gitea repo.
+
+Reads Gitea token from ~/.secrets/credentials.env (GITEA_ACCESS_TOKEN).
+"""
+import base64
+import json
+import pathlib
+import re
+import urllib.request
+
+REPO = "https://gitea.emsenhuber.net/api/v1/repos/admin/bf-golden-config"
+FILE = "jinja_templates/mikrotik_routeros.j2"
+TOKEN_PATH = pathlib.Path.home() / ".secrets/credentials.env"
+
+
+def get_token():
+    text = TOKEN_PATH.read_text()
+    m = re.search(r"^GITEA_ACCESS_TOKEN=(.+)$", text, re.MULTILINE)
+    if not m:
+        raise SystemExit("GITEA_ACCESS_TOKEN not found")
+    return m.group(1).strip()
+
+
+def main():
+    token = get_token()
+    src = pathlib.Path(__file__).parent.parent / "nautobot" / "mikrotik_routeros.j2"
+    content = src.read_text()
+
+    # fetch current SHA
+    req = urllib.request.Request(
+        f"{REPO}/contents/{FILE}?ref=main",
+        headers={"Authorization": f"token {token}"},
+    )
+    with urllib.request.urlopen(req) as resp:
+        meta = json.loads(resp.read().decode())
+    sha = meta["sha"]
+
+    payload = {
+        "content": base64.b64encode(content.encode()).decode(),
+        "sha": sha,
+        "message": "TP15: WG-HUB private key + ap1 cutover lease prep",
+        "branch": "main",
+    }
+    req2 = urllib.request.Request(
+        f"{REPO}/contents/{FILE}",
+        data=json.dumps(payload).encode(),
+        headers={
+            "Authorization": f"token {token}",
+            "Content-Type": "application/json",
+        },
+        method="PUT",
+    )
+    with urllib.request.urlopen(req2) as resp:
+        print(resp.status, json.loads(resp.read().decode()).get("commit", {}).get("id", "?"))
+
+
+if __name__ == "__main__":
+    main()