dc: vr1-dc0
output: overlays/vr1-dc0-vips.yaml
family: dual
legs:
- provider-public
- metal-admin
- metal-internal
prefixes_v4:
  provider-public: 10.12.4
  metal-admin: 10.12.8
  metal-internal: 10.12.12
source_v4: scripts/lib-net.sh lib_net_select_dc vr1-dc0
prefixes_v6:
  provider-public: 2602:f3e2:f02:11
  metal-admin: fd50:840e:74e2:220
  metal-internal: fd50:840e:74e2:221
apex_record: netbox/draft/vr1-office1-current-20260725.json
apps:
- name: keystone
  octet: 50
  comment: '# B1 front-loaded VIP; IS the catalog endpoint (B5, no os-public-hostname)'
- name: barbican
  octet: 51
  comment: '# B1'
- name: cinder
  octet: 52
  comment: '# B1'
- name: glance
  octet: 53
  comment: '# B1'
- name: magnum
  octet: 54
  comment: '# B1'
- name: neutron-api
  octet: 55
  comment: '# B1'
- name: nova-cloud-controller
  octet: 56
  comment: '# B1'
- name: octavia
  octet: 57
  comment: '# B1'
- name: openstack-dashboard
  octet: 58
  comment: '# B1 -- browse HTTPS by IP (B5); ALLOWED_HOSTS must permit the VIP IP (verify at deploy)'
- name: placement
  octet: 59
  comment: '# B1'
- name: ceph-radosgw
  octet: 60
  comment: '# B1 -- radosgw HA un-deferred for Roosevelt fidelity (decorative HA on testcloud)'
- name: vault
  octet: 61
  comment: '# R11 (D-020 amendment) -- was ruled in D-020''s own enumeration and never built'
- name: designate
  octet: 62
  comment: '# R11 (D-020 amendment) -- NEW to D-020''s enumeration; dnsaas is already provider-bound'
header: '# overlays/vr1-dc0-vips.yaml

  # Per-DC VIP overlay for vr1-dc0. GENERATED by scripts/render-dc-overlays.py from

  # render/values/vr1-dc0-vips.yaml -- edit the values file and re-render; do not

  # hand-edit this file.

  #   juju deploy ./bundle.yaml --overlay ./overlays/vr1-dc0-vips.yaml

  #

  # RULING 3 (2026-07-25) made bundle.yaml VIP-FREE, so this file is the ONLY source of

  # vr1-dc0''s VIPs and the bundle is not deployable without it.

  #

  # DUAL-FAMILY per R2 (RULED 2026-07-27): each vip carries the three v4 legs THEN the

  # three v6 legs, and `prefer-ipv6: true` travels WITH them -- the two must never be

  # separated (a merge that keeps prefer-ipv6 while dropping the v6 legs leaves HAProxy

  # bound on :::port with no v6 VIP for pacemaker to manage; provider-bundle-check

  # invariant 9 now rejects that pair). Column order is

  # provider-public / metal-admin / metal-internal, v4 then v6.

  #   v4 prefixes  MEASURED from scripts/lib-net.sh lib_net_select_dc vr1-dc0

  #   v6 prefixes  READ FROM THE NETBOX APEX (D-136 option (D)); the provider leg uses

  #                the DEDICATED GUA VIP /64, admin+internal their own plane /64s

  #   v6 host part MIRRORS the v4 octet textually (RULED 2026-07-27) -- .50 -> ::50

  #

  # vault .61 and designate .62 are R11 (a D-020 AMENDMENT, 2026-07-27). Per R6 these

  # land BEFORE overlays/dc-ha-scaleup.yaml, which is what gives vault a real HA target.

  # The B1 / B5 tokens below are DEFINED in bundle.yaml''s own header block.

  '