# dc-planes: the six per-DC plane segments (D-052 template, D-100 independent-
# cloud refinement) as isolated libvirt virtual networks.
#
# Deliberately isolated, not NAT/routed: OpenStack (Neutron/OVN) and NetBox own
# addressing and routing on these segments, not libvirt. The `forward` block is
# OMITTED entirely, which is documented native-libvirt behavior for a private,
# unforwarded virtual switch -- this repo could not confirm the current
# provider's `forward.mode` accepted string values from the published docs
# (the schema field exists; its value enum was not documented in prose form
# reachable this session). Confirm with `tofu providers schema -json` on a
# connected machine before the first real apply; if `mode = "none"` turns out
# to still be required explicitly, add it then -- do not guess it in now.
#
# `ips`/`dhcp` are likewise intentionally NOT set: NetBox is the IPAM apex
# (skill hard rule 3); libvirt-managed DHCP on these planes would create a
# second, conflicting source of truth for addresses OpenStack itself assigns.

resource "libvirt_network" "plane" {
  for_each = var.planes

  name      = "${var.dc_name}-${each.key}"
  autostart = true

  domain {
    name = "${each.key}.${var.dc_name}.${var.domain_suffix}"
  }

  mtu {
    size = var.mtu
  }
}