dc: vr1-dc1
output: overlays/vr1-dc1-vips.yaml
family: dual
legs:
- provider-public
- metal-admin
- metal-internal
prefixes_v4:
  provider-public: 10.12.64
  metal-admin: 10.12.68
  metal-internal: 10.12.72
source_v4: scripts/lib-net.sh lib_net_select_dc vr1-dc1
prefixes_v6:
  provider-public: 2602:f3e2:f03:11
  metal-admin: fd50:840e:74e2:320
  metal-internal: fd50:840e:74e2:321
apex_record: netbox/draft/vr1-office1-current-20260725.json
apps:
- name: keystone
  octet: 50
- name: barbican
  octet: 51
- name: cinder
  octet: 52
- name: glance
  octet: 53
- name: magnum
  octet: 54
- name: neutron-api
  octet: 55
- name: nova-cloud-controller
  octet: 56
- name: octavia
  octet: 57
- name: openstack-dashboard
  octet: 58
- name: placement
  octet: 59
- name: ceph-radosgw
  octet: 60
- name: vault
  octet: 61
- name: designate
  octet: 62
header: '# overlays/vr1-dc1-vips.yaml

  # Per-DC VIP overlay for vr1-dc1. GENERATED by scripts/render-dc-overlays.py from

  # render/values/vr1-dc1-vips.yaml -- edit the values file and re-render; do not

  # hand-edit this file.

  #   juju deploy ./bundle.yaml --overlay ./overlays/vr1-dc1-vips.yaml

  #

  # RULING 3 (2026-07-25) made bundle.yaml VIP-FREE, so this file is the ONLY source of

  # vr1-dc1''s VIPs and the bundle is not deployable without it.

  #

  # DUAL-FAMILY per R2 (RULED 2026-07-27): each vip carries the three v4 legs THEN the

  # three v6 legs, and `prefer-ipv6: true` travels WITH them -- the two must never be

  # separated (a merge that keeps prefer-ipv6 while dropping the v6 legs leaves HAProxy

  # bound on :::port with no v6 VIP for pacemaker to manage; provider-bundle-check

  # invariant 9 now rejects that pair). Column order is

  # provider-public / metal-admin / metal-internal, v4 then v6.

  #   v4 prefixes  MEASURED from scripts/lib-net.sh lib_net_select_dc vr1-dc1

  #   v6 prefixes  READ FROM THE NETBOX APEX (D-136 option (D)); the provider leg uses

  #                the DEDICATED GUA VIP /64, admin+internal their own plane /64s

  #   v6 host part MIRRORS the v4 octet textually (RULED 2026-07-27) -- .50 -> ::50

  #

  # vault .61 and designate .62 are R11 (a D-020 AMENDMENT, 2026-07-27). Per R6 these

  # land BEFORE overlays/dc-ha-scaleup.yaml, which is what gives vault a real HA target.

  # The B1 / B5 tokens below are DEFINED in bundle.yaml''s own header block.

  '