# Nautobot Golden Config -- intended RouterOS config for {{ obj.name }}
# Generated from Nautobot device data + hardcoded TP15 L3 staged values.
# Scope: identity for all MikroTik devices; full staged L3 cutover config for crs326-core.

/system identity set name={{ obj.name }}

{% if obj.name == "crs326-core" %}
# =====================================================================================
# TP15 — crs326-core L3 staged config (ap1 -> core).  NICHT automatisch aktivieren.
# Alles Betriebsumlenkende wird disabled=yes angelegt; Cutover aktiviert in einem Rutsch.
# =====================================================================================

# [1] INTERFACE-LISTS
/interface/list add name=WAN comment="TP15"
/interface/list add name=LAN comment="TP15"
/interface/list/member add list=WAN interface=vlan100
/interface/list/member add list=LAN interface=vlan10
/interface/list/member add list=LAN interface=vlan20
/interface/list/member add list=LAN interface=vlan30
/interface/list/member add list=LAN interface=vlan40
/interface/list/member add list=LAN interface=vlan50
/interface/list/member add list=LAN interface=vlan90
/interface/list/member add list=LAN interface=vlan99

# [2] GW-IPs je VLAN — STAGED (disabled=yes)
/ip/address
{% for iface in obj.interfaces.all() %}
{%   if iface.name.startswith("vlan") %}
{%     for ip in iface.ip_addresses.all() %}
{%       if ip.host == "10.40." + iface.name|replace("vlan", "") + ".1" %}
add address={{ ip.address }} interface={{ iface.name }} comment="{{ iface.description }}" disabled=yes
{%       endif %}
{%     endfor %}
{%   endif %}
{% endfor %}

# [3] WAN DHCP-Client (Liwest/Arris) — STAGED
/ip/dhcp-client add interface=vlan100 use-peer-dns=no add-default-route=yes \
  comment="TP15 WAN Liwest (Arris)" disabled=yes

# [4] DHCP-Server je VLAN
/ip/pool add name=pool-v10 ranges=10.40.10.100-10.40.10.200
/ip/pool add name=pool-v20 ranges=10.40.20.100-10.40.20.200
/ip/pool add name=pool-v30 ranges=10.40.30.100-10.40.30.250
/ip/pool add name=pool-v40 ranges=10.40.40.100-10.40.40.200
/ip/pool add name=pool-v50 ranges=10.40.50.100-10.40.50.200
/ip/pool add name=pool-v90 ranges=10.40.90.100-10.40.90.200
/ip/pool add name=pool-v99 ranges=10.40.99.100-10.40.99.200

/ip/dhcp-server/network add address=10.40.10.0/24 gateway=10.40.10.1 dns-server=10.40.10.1 domain=bf.lan
/ip/dhcp-server/network add address=10.40.20.0/24 gateway=10.40.20.1 dns-server=10.40.20.1 domain=bf.lan
/ip/dhcp-server/network add address=10.40.30.0/24 gateway=10.40.30.1 dns-server=10.40.30.1 domain=bf.lan
/ip/dhcp-server/network add address=10.40.40.0/24 gateway=10.40.40.1 dns-server=10.40.40.1 domain=bf.lan
/ip/dhcp-server/network add address=10.40.50.0/24 gateway=10.40.50.1 dns-server=10.40.50.1 domain=bf.lan
/ip/dhcp-server/network add address=10.40.90.0/24 gateway=10.40.90.1 dns-server=10.40.90.1 domain=bf.lan
/ip/dhcp-server/network add address=10.40.99.0/24 gateway=10.40.99.1 dns-server=10.40.99.1 domain=bf.lan

/ip/dhcp-server add name=dhcp-v10 interface=vlan10 address-pool=pool-v10 lease-time=1d add-dns-entries-suffix=lan comment=MAIN      disabled=yes
/ip/dhcp-server add name=dhcp-v20 interface=vlan20 address-pool=pool-v20 lease-time=1d add-dns-entries-suffix=lan comment=INFRA     disabled=yes
/ip/dhcp-server add name=dhcp-v30 interface=vlan30 address-pool=pool-v30 lease-time=1d add-dns-entries-suffix=lan comment=IOT       disabled=yes
/ip/dhcp-server add name=dhcp-v40 interface=vlan40 address-pool=pool-v40 lease-time=1d add-dns-entries-suffix=lan comment=MEDIA     disabled=yes
/ip/dhcp-server add name=dhcp-v50 interface=vlan50 address-pool=pool-v50 lease-time=1d add-dns-entries-suffix=lan comment=UNTRUSTED disabled=yes
/ip/dhcp-server add name=dhcp-v90 interface=vlan90 address-pool=pool-v90 lease-time=12h add-dns-entries-suffix=lan comment=GUEST    disabled=yes
/ip/dhcp-server add name=dhcp-v99 interface=vlan99 address-pool=pool-v99 lease-time=1d add-dns-entries-suffix=lan comment=MGMT      disabled=yes

# [5] DNS
/ip/dns set allow-remote-requests=yes servers=1.1.1.1 \
  use-doh-server=https://px35ynlol3.cloudflare-gateway.com/dns-query verify-doh-cert=yes \
  mdns-repeat-ifaces=vlan10,vlan20,vlan40,vlan30,vlan90

/ip/dns/static add name=router.lan       address=10.40.99.1   comment="core = GW/Router"
/ip/dns/static add name=ap1.bf.lan       address=10.40.99.3   comment="ap1 = reiner AP"
/ip/dns/static add name=ap2.bf.lan       address=10.40.99.2   comment="ap2 = reiner AP"
/ip/dns/static add name=core.bf.lan      address=10.40.99.1   comment="crs326-core (L3)"
/ip/dns/static add name=branch.bf.lan    address=10.40.99.12  comment="crs326-branch (nach Renumber .13->.12)"
/ip/dns/static add name=macmini.bf.lan   address=10.40.20.167
/ip/dns/static add name=pve.bf.lan       address=10.40.20.100
/ip/dns/static add name=pve-mcp.bf.lan   address=10.40.20.173
/ip/dns/static add name=nas.bf.lan       address=10.40.20.10
/ip/dns/static add name=docker.bf.lan    address=10.40.20.126
/ip/dns/static add name=platform-pg.bf.lan address=10.40.20.20

# [6] NAT
/ip/firewall/nat add chain=srcnat dst-address=10.40.0.0/16 action=accept \
  comment="TP4: no-NAT inter-VLAN (vor masquerade)"
/ip/firewall/nat add chain=srcnat out-interface-list=WAN action=masquerade \
  comment="defconf: masquerade WAN"

# [7] FIREWALL FILTER
/ip/firewall/filter add chain=forward action=accept connection-state=established,related,untracked comment="defconf: accept est,rel,untracked"
/ip/firewall/filter add chain=forward action=fasttrack-connection connection-state=established,related comment="defconf: fasttrack"
/ip/firewall/filter add chain=forward action=drop connection-state=invalid comment="defconf: drop invalid"
/ip/firewall/filter add chain=forward action=drop connection-nat-state=!dstnat in-interface-list=WAN comment="defconf: drop WAN !dstnat"
/ip/firewall/filter add chain=forward action=accept in-interface=wg-hub  comment="TP10: allow from WG spokes (FM/DW)"
/ip/firewall/filter add chain=forward action=accept out-interface=wg-hub comment="TP10: allow to WG spokes (FM/DW)"
/ip/firewall/filter add chain=forward action=accept in-interface=vlan10 out-interface=vlan40 comment="TP5: MAIN->MEDIA (AirPlay/Sonos)"
/ip/firewall/filter add chain=forward action=accept in-interface=vlan40 out-interface=vlan10 comment="TP5: MEDIA->MAIN"
/ip/firewall/filter add chain=forward action=accept in-interface=vlan20 out-interface=vlan40 comment="TP5: INFRA->MEDIA (HA<->Sonos)"
/ip/firewall/filter add chain=forward action=accept in-interface=vlan40 out-interface=vlan20 comment="TP5: MEDIA->INFRA"
/ip/firewall/filter add chain=forward action=accept in-interface=vlan90 out-interface=vlan40 comment="TP5: GUEST->MEDIA (Sonos/Cast)"
/ip/firewall/filter add chain=forward action=accept in-interface=vlan40 out-interface=vlan90 comment="TP5: MEDIA->GUEST"

/ip/firewall/filter add chain=input action=accept connection-state=established,related,untracked comment="TP10-seal-est"
/ip/firewall/filter add chain=input action=drop connection-state=invalid comment="TP10-seal-inv"
/ip/firewall/filter add chain=input action=accept protocol=udp dst-port=51821 comment="TP10: WG hub listen"
/ip/firewall/filter add chain=input action=accept protocol=udp dst-port=68 in-interface-list=WAN comment="TP10-seal-dhcp"
/ip/firewall/filter add chain=input action=accept protocol=icmp comment="TP10-seal-icmp"
/ip/firewall/filter add chain=input action=accept in-interface-list=LAN comment="TP10-seal-lan"
/ip/firewall/filter add chain=input action=drop in-interface-list=WAN comment="TP10-seal-wandrop"
/ip/firewall/filter add chain=input action=accept protocol=udp dst-port=5353 in-interface=vlan10 comment="TP5: mDNS in vlan10"
/ip/firewall/filter add chain=input action=accept protocol=udp dst-port=5353 in-interface=vlan40 comment="TP5: mDNS in vlan40"
/ip/firewall/filter add chain=input action=accept protocol=udp dst-port=5353 in-interface=vlan20 comment="TP5: mDNS in vlan20"
/ip/firewall/filter add chain=input action=accept protocol=udp dst-port=5353 in-interface=vlan30 comment="TP5: mDNS in vlan30"
/ip/firewall/filter add chain=input action=accept protocol=udp dst-port=5353 in-interface=vlan90 comment="TP5: mDNS in vlan90"

# [8] WG-HUB (TP10 Multi-Site) — private-key wird im Cutover-Fenster gesetzt
/interface/wireguard add name=wg-hub mtu=1412 listen-port=51821 private-key="<<< AP1_WG_HUB_PRIVKEY >>>" \
  comment="TP10 Multi-Site VPN Hub (FM/DW spokes)" disabled=yes
/interface/wireguard/peers add interface=wg-hub name=fm allowed-address=10.101.0.0/24 \
  public-key="dzRY0lnnUygijChWe5wXZmXPeNcbdALpqBptA3fyiVE=" \
  endpoint-address=abxhutfgsid9snmy.myfritz.net endpoint-port=52476
/interface/wireguard/peers add interface=wg-hub name=dw allowed-address=10.95.10.0/24 \
  public-key="FqYZLztQ/qME5VDie5QLGH++5299WJiE1dPpQnPbzUw="
/ip/route add dst-address=10.101.0.0/24 gateway=wg-hub comment="TP10: FM spoke -> wg-hub"
/ip/route add dst-address=10.95.10.0/24 gateway=wg-hub comment="TP10: DW spoke -> wg-hub"
{% endif %}