# Changelog 2026-07-12 -- DOCFIX-185: OPNsense edge is a real-ISP router, not an egress-airgap

**Context.** While building the Office1 OPNsense edge, the config template's firewall
turned out to be **DC-airgap-shaped** (WAN `direction=out` default-deny except NTP + a
per-DC artifact-mirror sync). Operator clarified the transport model, correcting a
misunderstanding baked into the template:

> Each site (both DCs and Office) simulates its **own real ISP connection** -- the OPNsense
> edge is a normal internet-facing router. The **dark fiber (mesh links) is East-West /
> replication only**, NOT an internet path. D-107's node-level artifact posture (per-DC
> mirror; nodes not pulling directly from the public internet) is a **separate** DC-node /
> routing concern, not the edge's WAN egress.

## What changed
- **`opentofu/templates/opnsense-config.xml.tmpl`**: removed the three WAN-egress-control
  rules (`seq 20` NTP-only, `seq 21` mirror-only, `seq 99` default-deny-out) and the
  `MIRROR_SYNC_PROTOCOL`/`MIRROR_UPSTREAM_NET`/`MIRROR_SYNC_PORT` tokens they used. The edge
  now allows normal outbound (LAN allow-any + default outbound NAT); WAN inbound stays
  default-deny + `blockpriv`/`blockbogons`. A comment records the rationale.
- **`scripts/opnsense-render-config.sh`**: `MIRROR_*` dropped from `REQUIRED_VARS`.
- **`tests/opnsense-render-config/run-tests.sh`**: `MIRROR_*` export removed / unset.
  (An XML-comment `--` bug in the first template edit was caught by the harness's
  well-formed-XML test and fixed -- double-hyphens are illegal inside XML comments.)

## Verification
- `bash tests/opnsense-render-config/run-tests.sh` -> ALL PASS (8/8). `repo-lint` 0 fail.
- Rendered Office1's real config (2 firewall rules = LAN allow-any inet/inet6; egress-control
  gone), well-formed, no leftover tokens.

## Follow-up (flagged, not actioned)
- The clarified transport model (real-ISP-per-site; dark fiber East-West-only; edges are
  normal routers; node-airgap is a separate DC concern) is a **design clarification** that
  should carry a short amendment note under **D-100** (fabric) and/or **D-107** (airgap) so
  the DC-edge configs (Stage 3) are built to the same understanding, not the egress-airgap
  one. Operator to rule whether to formalize as a D-amendment.

## Revert
- `git checkout opentofu/templates/opnsense-config.xml.tmpl scripts/opnsense-render-config.sh
  tests/opnsense-render-config/run-tests.sh`; `git rm` this changelog.