<?xml version="1.0"?>
<opnsense>
  <trigger_initial_wizard/>
  <theme>opnsense</theme>
  <system>
    <optimization>normal</optimization>
    <hostname>{{OPNSENSE_HOSTNAME}}</hostname>
    <domain>{{DOMAIN}}</domain>
    <dnsallowoverride>1</dnsallowoverride>
    <dnsallowoverride_exclude/>
    <group>
      <name>admins</name>
      <description>System Administrators</description>
      <scope>system</scope>
      <gid>1999</gid>
      <member>0</member>
      <priv>page-all</priv>
    </group>
    <user>
      <name>root</name>
      <descr>System Administrator</descr>
      <scope>system</scope>
      <groupname>admins</groupname>
      <password>{{ROOT_PASSWORD_HASH}}</password>
      <uid>0</uid>
      <!-- BASE64-encoded authorized_keys. OPNsense base64_decode()s this and writes it to
           ~/.ssh/authorized_keys (verified in upstream src/etc/inc/auth.inc:
           `$keys = base64_decode($user['authorizedkeys']);`). Without it, applying this
           config would leave the edge with NO key-based access at all. -->
      <authorizedkeys>{{ROOT_AUTHORIZED_KEYS_B64}}</authorizedkeys>
    </user>
    <timezone>Etc/UTC</timezone>
    <timeservers>{{NTP_UPSTREAM_SERVERS}}</timeservers>
    <webgui>
      <protocol>https</protocol>
    </webgui>
    <disablenatreflection>yes</disablenatreflection>
    <usevirtualterminal>1</usevirtualterminal>
    <disableconsolemenu/>
    <!-- SERIAL CONSOLE. NOT optional: this edge is a VM with NO VIDEO DEVICE, so the serial
         port is its ONLY console and its only break-glass path. Omitting these keys applied a
         config whose console was not serial, and the console went permanently silent after the
         first reboot (measured 2026-07-12). The box stayed reachable purely because SSH was
         enabled; without that it would have been unmanageable.
         Key names verified against upstream src/www/system_advanced_admin.php: `primaryconsole`
         and `serialspeed` are STRING values. (There is no `enableserial` in OPNsense; that is a
         pfSense key. Do not add it.) 115200 matches the nano image's own /boot.config -S115200. -->
    <primaryconsole>serial</primaryconsole>
    <serialspeed>115200</serialspeed>
    <ipv6allow>1</ipv6allow>
    <bogons>
      <interval>monthly</interval>
    </bogons>
    <pf_share_forward>1</pf_share_forward>
    <!-- SSH. Element names verified against upstream src/www/system_advanced_admin.php:
         `enabled` is the literal STRING "enabled"; `permitrootlogin` and `passwordauth` are
         PRESENCE-checked (isset), so omitting passwordauth means password auth is OFF.
         D-112(c) makes SSH the management path for this edge, so it MUST be on. The previous
         template had only the group element (no enable, no key), so applying it would have
         DISABLED sshd and installed no key, leaving management reachable only via console.
         Key-only auth is deliberate; the serial console remains the break-glass fallback. -->
    <ssh>
      <enabled>enabled</enabled>
      <permitrootlogin>1</permitrootlogin>
      <group>admins</group>
    </ssh>
  </system>
  <interfaces>
    <wan>
      <enable>1</enable>
      <if>{{WAN_IF}}</if>
      <mtu/>
      <ipaddr>{{WAN_IPADDR}}</ipaddr>
      <subnet>{{WAN_SUBNET_BITS}}</subnet>
      <gateway>WAN_GW</gateway>
      <blockpriv>1</blockpriv>
      <blockbogons>1</blockbogons>
    </wan>
    <lan>
      <enable>1</enable>
      <if>{{LAN_IF}}</if>
      <ipaddr>{{LAN_IPADDR}}</ipaddr>
      <subnet>{{LAN_SUBNET_BITS}}</subnet>
    </lan>
  </interfaces>
  <gateways>
    <gateway_item>
      <interface>wan</interface>
      <gateway>{{WAN_GATEWAY}}</gateway>
      <name>WAN_GW</name>
      <weight>1</weight>
      <ipprotocol>inet</ipprotocol>
      <descr>simulated ISP uplink gateway (D-100)</descr>
    </gateway_item>
  </gateways>
  <staticroutes>
{{ROUTE1_BLOCK}}
{{ROUTE2_BLOCK}}
  </staticroutes>
  <unbound>
    <enable>1</enable>
  </unbound>
  <nat>
    <outbound>
      <mode>automatic</mode>
    </outbound>
  </nat>
  <filter>
  </filter>
  <rrd>
    <enable/>
  </rrd>
  <ntpd>
    <prefer>{{NTP_PREFER_SERVER}}</prefer>
    <ispool>{{NTP_UPSTREAM_SERVERS}}</ispool>
  </ntpd>
  <OPNsense>
    <Firewall>
      <Filter>
        <rules>
          <rule>
            <enabled>1</enabled>
            <statetype>keep</statetype>
            <sequence>1</sequence>
            <action>pass</action>
            <quick>1</quick>
            <interface>lan</interface>
            <direction>in</direction>
            <ipprotocol>inet</ipprotocol>
            <protocol>any</protocol>
            <source_net>lan</source_net>
            <destination_net>any</destination_net>
            <description>Default allow LAN to any rule</description>
          </rule>
          <rule>
            <enabled>1</enabled>
            <statetype>keep</statetype>
            <sequence>11</sequence>
            <action>pass</action>
            <quick>1</quick>
            <interface>lan</interface>
            <direction>in</direction>
            <ipprotocol>inet6</ipprotocol>
            <protocol>any</protocol>
            <source_net>lan</source_net>
            <destination_net>any</destination_net>
            <description>Default allow LAN IPv6 to any rule</description>
          </rule>
          <!-- Edge is a normal simulated-ISP router (DOCFIX-185). Outbound is
               allowed by the LAN allow-any rules above + default outbound NAT;
               WAN inbound is default-deny (plus blockpriv/blockbogons on the wan
               interface). The earlier D-107 WAN-egress-control rules (NTP-only +
               mirror-only + default-deny-out, and the MIRROR_* tokens) were
               REMOVED: they modeled an egress-airgap that does not match this
               project's real transport model. Each site (both DCs and Office)
               has its own simulated-ISP internet uplink; the dark fiber is
               East-West/replication only, NOT an internet path. D-107's
               node-level artifact posture (per-DC mirror; nodes not pulling
               directly from the public internet) is a separate DC-node/routing
               concern, not the edge's WAN egress. -->
        </rules>
        <snatrules/>
        <npt/>
        <onetoone/>
      </Filter>
    </Firewall>
  </OPNsense>
</opnsense>
