Fork: 0
OpenStack / openstack-caracal-dc-dc
Transfer to URL with SHA Find file
Newer
Older
openstack-caracal-dc-dc / docs / changelog-20260712-opnsense-edge-real-isp-router.md
@JANeumatrix JANeumatrix 1 day ago 2 KB Office1 OPNsense edge build: real-ISP-router config + first-boot fixes
Raw Blame History

Changelog 2026-07-12 -- DOCFIX-185: OPNsense edge is a real-ISP router, not an egress-airgap

Context. While building the Office1 OPNsense edge, the config template's firewall turned out to be DC-airgap-shaped (WAN direction=out default-deny except NTP + a per-DC artifact-mirror sync). Operator clarified the transport model, correcting a misunderstanding baked into the template:

Each site (both DCs and Office) simulates its own real ISP connection -- the OPNsense edge is a normal internet-facing router. The dark fiber (mesh links) is East-West / replication only, NOT an internet path. D-107's node-level artifact posture (per-DC mirror; nodes not pulling directly from the public internet) is a separate DC-node / routing concern, not the edge's WAN egress.

What changed

  • opentofu/templates/opnsense-config.xml.tmpl: removed the three WAN-egress-control rules (seq 20 NTP-only, seq 21 mirror-only, seq 99 default-deny-out) and the MIRROR_SYNC_PROTOCOL/MIRROR_UPSTREAM_NET/MIRROR_SYNC_PORT tokens they used. The edge now allows normal outbound (LAN allow-any + default outbound NAT); WAN inbound stays default-deny + blockpriv/blockbogons. A comment records the rationale.
  • scripts/opnsense-render-config.sh: MIRROR_* dropped from REQUIRED_VARS.
  • tests/opnsense-render-config/run-tests.sh: MIRROR_* export removed / unset. (An XML-comment -- bug in the first template edit was caught by the harness's well-formed-XML test and fixed -- double-hyphens are illegal inside XML comments.)

Verification

  • bash tests/opnsense-render-config/run-tests.sh -> ALL PASS (8/8). repo-lint 0 fail.
  • Rendered Office1's real config (2 firewall rules = LAN allow-any inet/inet6; egress-control gone), well-formed, no leftover tokens.

Follow-up (flagged, not actioned)

  • The clarified transport model (real-ISP-per-site; dark fiber East-West-only; edges are normal routers; node-airgap is a separate DC concern) is a design clarification that should carry a short amendment note under D-100 (fabric) and/or D-107 (airgap) so the DC-edge configs (Stage 3) are built to the same understanding, not the egress-airgap one. Operator to rule whether to formalize as a D-amendment.

Revert

  • git checkout opentofu/templates/opnsense-config.xml.tmpl scripts/opnsense-render-config.sh tests/opnsense-render-config/run-tests.sh; git rm this changelog.