<?xml version="1.0"?>
<opnsense>
  <trigger_initial_wizard/>
  <theme>opnsense</theme>
  <system>
    <optimization>normal</optimization>
    <hostname>{{OPNSENSE_HOSTNAME}}</hostname>
    <domain>{{DOMAIN}}</domain>
    <dnsallowoverride>1</dnsallowoverride>
    <dnsallowoverride_exclude/>
    <group>
      <name>admins</name>
      <description>System Administrators</description>
      <scope>system</scope>
      <gid>1999</gid>
      <member>0</member>
      <priv>page-all</priv>
    </group>
    <user>
      <name>root</name>
      <descr>System Administrator</descr>
      <scope>system</scope>
      <groupname>admins</groupname>
      <password>{{ROOT_PASSWORD_HASH}}</password>
      <uid>0</uid>
    </user>
    <timezone>Etc/UTC</timezone>
    <timeservers>{{NTP_UPSTREAM_SERVERS}}</timeservers>
    <webgui>
      <protocol>https</protocol>
    </webgui>
    <disablenatreflection>yes</disablenatreflection>
    <usevirtualterminal>1</usevirtualterminal>
    <disableconsolemenu/>
    <ipv6allow>1</ipv6allow>
    <bogons>
      <interval>monthly</interval>
    </bogons>
    <pf_share_forward>1</pf_share_forward>
    <ssh>
      <group>admins</group>
    </ssh>
  </system>
  <interfaces>
    <wan>
      <enable>1</enable>
      <if>{{WAN_IF}}</if>
      <mtu/>
      <ipaddr>{{WAN_IPADDR}}</ipaddr>
      <subnet>{{WAN_SUBNET_BITS}}</subnet>
      <gateway>WAN_GW</gateway>
      <blockpriv>1</blockpriv>
      <blockbogons>1</blockbogons>
    </wan>
    <lan>
      <enable>1</enable>
      <if>{{LAN_IF}}</if>
      <ipaddr>{{LAN_IPADDR}}</ipaddr>
      <subnet>{{LAN_SUBNET_BITS}}</subnet>
    </lan>
  </interfaces>
  <gateways>
    <gateway_item>
      <interface>wan</interface>
      <gateway>{{WAN_GATEWAY}}</gateway>
      <name>WAN_GW</name>
      <weight>1</weight>
      <ipprotocol>inet</ipprotocol>
      <descr>simulated ISP uplink gateway (D-100)</descr>
    </gateway_item>
  </gateways>
  <staticroutes>
{{ROUTE1_BLOCK}}
{{ROUTE2_BLOCK}}
  </staticroutes>
  <unbound>
    <enable>1</enable>
  </unbound>
  <nat>
    <outbound>
      <mode>automatic</mode>
    </outbound>
  </nat>
  <filter>
  </filter>
  <rrd>
    <enable/>
  </rrd>
  <ntpd>
    <prefer>{{NTP_PREFER_SERVER}}</prefer>
    <ispool>{{NTP_UPSTREAM_SERVERS}}</ispool>
  </ntpd>
  <OPNsense>
    <Firewall>
      <Filter>
        <rules>
          <rule>
            <enabled>1</enabled>
            <statetype>keep</statetype>
            <sequence>1</sequence>
            <action>pass</action>
            <quick>1</quick>
            <interface>lan</interface>
            <direction>in</direction>
            <ipprotocol>inet</ipprotocol>
            <protocol>any</protocol>
            <source_net>lan</source_net>
            <destination_net>any</destination_net>
            <description>Default allow LAN to any rule</description>
          </rule>
          <rule>
            <enabled>1</enabled>
            <statetype>keep</statetype>
            <sequence>11</sequence>
            <action>pass</action>
            <quick>1</quick>
            <interface>lan</interface>
            <direction>in</direction>
            <ipprotocol>inet6</ipprotocol>
            <protocol>any</protocol>
            <source_net>lan</source_net>
            <destination_net>any</destination_net>
            <description>Default allow LAN IPv6 to any rule</description>
          </rule>
          <!-- Edge is a normal simulated-ISP router (DOCFIX-185). Outbound is
               allowed by the LAN allow-any rules above + default outbound NAT;
               WAN inbound is default-deny (plus blockpriv/blockbogons on the wan
               interface). The earlier D-107 WAN-egress-control rules (NTP-only +
               mirror-only + default-deny-out, and the MIRROR_* tokens) were
               REMOVED: they modeled an egress-airgap that does not match this
               project's real transport model. Each site (both DCs and Office)
               has its own simulated-ISP internet uplink; the dark fiber is
               East-West/replication only, NOT an internet path. D-107's
               node-level artifact posture (per-DC mirror; nodes not pulling
               directly from the public internet) is a separate DC-node/routing
               concern, not the edge's WAN egress. -->
        </rules>
        <snatrules/>
        <npt/>
        <onetoone/>
      </Filter>
    </Firewall>
  </OPNsense>
</opnsense>