# site-wan: NAT'd per-site ISP uplink (see variables.tf for rationale).
#
# SCHEMA NOTE: this provider (registry.opentofu.org/dmacvicar/libvirt) uses
# attribute-style nested objects, confirmed 2026-07-15 via
# `tofu providers schema -json` (the method dc-planes/main.tf calls for):
#   forward = { mode = "nat" }        (nesting=single; no top-level `mode`)
#   ips     = [ { address, prefix } ] (nesting=list)
#   mtu     = { size = N }            (nesting=single; matches dc-planes)
#   domain  = { name = ... }          (nesting=single; matches dc-planes)
# This mirrors the live `office1-wan` (virsh): <forward mode='nat'>, .1/24.
# DHCP is intentionally OMITTED -- the only client is the edge, whose WAN is
# static (office1-opnsense's WAN is .2, outside office1-wan's DHCP range).

resource "libvirt_network" "site_wan" {
  name      = var.network_name
  autostart = true

  forward = {
    mode = "nat"
  }

  domain = {
    name = var.network_name
  }

  mtu = {
    size = var.mtu
  }

  ips = [
    {
      address = cidrhost(var.cidr, 1)
      prefix  = tonumber(split("/", var.cidr)[1])
    }
  ]
}