# =====================================================================
# vr1-dc1 INNER SUBSTRATE (G12, authored 2026-07-21) -- D-123 MODEL B, created
# inside vvr1-dc1. MIRROR of opentofu/vr1-dc0-substrate/main.tf (the pattern of
# record: its comments carry the measured traps -- provider dial, known_hosts,
# upload-from-executing-host -- and apply here unchanged). Run this root AFTER:
# (1) the outer opentofu/ root has booted + sized vvr1-dc1, and (2) the bootstrap
# gate (site-headend-install.sh node-host mode) has installed libvirtd + the
# inner pool + kvm nested=1 + the OPNsense base image on vvr1-dc1.
# =====================================================================

provider "libvirt" {
  # qemu+ssh to vvr1-dc1 over the office1<->dc1 transit. Key auth + known_hosts
  # verified out of band (NO no_verify). The IP is MEASURED after the outer apply
  # (hard rule 2). keyfile + sshauth are REQUIRED URI params (dc0, measured
  # 2026-07-20: the provider's Go ssh transport ignores ~/.ssh/config and default
  # identities). known_hosts: ALL key types must be present (dc0's measured
  # "knownhosts: key mismatch" trap; seed via ssh-keyscan, cross-checked).
  uri = "qemu+ssh://${var.vvr1_dc1_ssh_user}@${var.vvr1_dc1_transit_ip}/system?keyfile=${var.vvr1_dc1_ssh_keyfile}&sshauth=privkey"
}

# Inner storage pool (backs the node + edge disks) -- created inside vvr1-dc1 at
# the path the bootstrap step provisioned.
module "inner_storage" {
  source      = "../modules/dc-storage-pool"
  dc_name     = "vr1-dc1-inner"
  target_path = var.inner_pool_path
}

# The six vr1-dc1 planes (D-124 amendment 2026-07-21 layout -- contiguous /22s in
# 10.12.64.0/19, dc0's role ORDER kept) -- isolated-L2 networks INSIDE vvr1-dc1.
# metal-admin is where the rack serves PXE/DHCP to the inner nodes.
module "vr1_dc1_planes" {
  source        = "../modules/dc-planes"
  dc_name       = "vr1-dc1"
  domain_suffix = var.domain_suffix
  mtu           = var.underlay_mtu
  planes        = var.vr1_dc1_planes
}

# D-125 bridge-in (dc0 pattern, PROVEN there end to end): the DC WAN segment is a
# BRIDGE onto vvr1-dc1's br-vr1-dc1-wan (the IP-less uplink NIC on the vcloud ISP
# NAT `vr1-dc1-uplink` = 172.30.3.0/24, declared in the outer root's vvr1-dc1
# netplan). ONE NAT, at vcloud. host_bridge MUST match the netplan bridge name in
# opentofu/main.tf. The D-125 egress isolation gate re-runs at dc1 standup.
module "vr1_dc1_wan" {
  source       = "../modules/wan-bridge"
  network_name = "vr1-dc1-wan"
  host_bridge  = "br-vr1-dc1-wan"
  # mtu defaults to 1500 (ISP-uplink domain; NOT the jumbo planes/mesh).
}

# D-122: the DC edge -- 2-NIC (WAN + LAN), Office1 pattern (2048/2/nano). LAN =
# provider-public (external gateway, D-100; ruled gw 10.12.64.1 per the D-124
# amendment); WAN = the dedicated uplink above (static .2 on 172.30.3.0/24, set
# via the D-113 API path at the standup addressing step, not here).
module "vr1_dc1_opnsense" {
  source           = "../modules/opnsense-edge"
  vm_name          = "vr1-dc1-opnsense"
  autostart        = true # D-127: the DC edge comes up with its containment VM (routing for the site)
  memory_mib       = 2048
  vcpu             = 2
  pool_name        = module.inner_storage.pool_name
  base_volume_path = var.opnsense_base_path
  lan_network_name = module.vr1_dc1_planes.network_names["provider-public"]
  wan_network_name = module.vr1_dc1_wan.network_name
  # D-129: NEW DC edges boot WITH the qga channel so they never need the retrofit
  # (operator-ruled 2026-07-20).
  expose_qga_channel = true
}

# D-121 Option C layout (per-DC): 3 control + 2 compute + 4 storage = 9 nodes.
# Six NICs each (one per plane); metal-admin FIRST = PXE/boot plane (D-052 default
# binding).
locals {
  vr1_dc1_node_nics = [
    module.vr1_dc1_planes.network_names["metal-admin"], # PXE / boot fabric first
    module.vr1_dc1_planes.network_names["provider-public"],
    module.vr1_dc1_planes.network_names["metal-internal"],
    module.vr1_dc1_planes.network_names["data-tenant"],
    module.vr1_dc1_planes.network_names["storage"],
    module.vr1_dc1_planes.network_names["replication"],
  ]

  # macs: PRE-ASSIGNED at authoring (2026-07-21) so the fleet is pinned from the
  # FIRST apply -- the D-124-amendment standup invariant, and the direct lesson of
  # dc0's 2026-07-20 incident (unpinned MACs regenerated by an in-place apply
  # stranded the whole fleet in MAAS; dc0 had to measure-and-pin after the fact).
  # Scheme, deterministic and collision-free by construction:
  #   52:54:01:d1:NN:PP
  #   ^^^^^^^^ locally-administered unicast (bit 0x02 of octet 1), one octet away
  #            from libvirt's auto-generation space 52:54:00:* -- an auto MAC can
  #            never collide with these.
  #        ^^ d1 tags vr1-DC1 (dc0's pins are measured 52:54:00 values, not this
  #           scheme; future DCs take their own tag octet).
  #           NN = node ordinal 01..09 in the map order below;
  #           PP = NIC ordinal 01..06 in vr1_dc1_node_nics order (metal-admin
  #           first). These are IDENTITY values, not tunables -- change one and
  #           MAAS no longer knows the node.
  vr1_dc1_nodes = {
    "vr1-dc1-control-01" = { vcpu = 16, mem = 65536, disk_gib = 150, macs = [
      "52:54:01:d1:01:01", "52:54:01:d1:01:02", "52:54:01:d1:01:03",
      "52:54:01:d1:01:04", "52:54:01:d1:01:05", "52:54:01:d1:01:06",
    ] }
    "vr1-dc1-control-02" = { vcpu = 16, mem = 65536, disk_gib = 150, macs = [
      "52:54:01:d1:02:01", "52:54:01:d1:02:02", "52:54:01:d1:02:03",
      "52:54:01:d1:02:04", "52:54:01:d1:02:05", "52:54:01:d1:02:06",
    ] }
    "vr1-dc1-control-03" = { vcpu = 16, mem = 65536, disk_gib = 150, macs = [
      "52:54:01:d1:03:01", "52:54:01:d1:03:02", "52:54:01:d1:03:03",
      "52:54:01:d1:03:04", "52:54:01:d1:03:05", "52:54:01:d1:03:06",
    ] }
    "vr1-dc1-compute-01" = { vcpu = 12, mem = 49152, disk_gib = 100, macs = [
      "52:54:01:d1:04:01", "52:54:01:d1:04:02", "52:54:01:d1:04:03",
      "52:54:01:d1:04:04", "52:54:01:d1:04:05", "52:54:01:d1:04:06",
    ] }
    "vr1-dc1-compute-02" = { vcpu = 12, mem = 49152, disk_gib = 100, macs = [
      "52:54:01:d1:05:01", "52:54:01:d1:05:02", "52:54:01:d1:05:03",
      "52:54:01:d1:05:04", "52:54:01:d1:05:05", "52:54:01:d1:05:06",
    ] }
    "vr1-dc1-storage-01" = { vcpu = 8, mem = 24576, disk_gib = 550, macs = [
      "52:54:01:d1:06:01", "52:54:01:d1:06:02", "52:54:01:d1:06:03",
      "52:54:01:d1:06:04", "52:54:01:d1:06:05", "52:54:01:d1:06:06",
    ] }
    "vr1-dc1-storage-02" = { vcpu = 8, mem = 24576, disk_gib = 550, macs = [
      "52:54:01:d1:07:01", "52:54:01:d1:07:02", "52:54:01:d1:07:03",
      "52:54:01:d1:07:04", "52:54:01:d1:07:05", "52:54:01:d1:07:06",
    ] }
    "vr1-dc1-storage-03" = { vcpu = 8, mem = 24576, disk_gib = 550, macs = [
      "52:54:01:d1:08:01", "52:54:01:d1:08:02", "52:54:01:d1:08:03",
      "52:54:01:d1:08:04", "52:54:01:d1:08:05", "52:54:01:d1:08:06",
    ] }
    "vr1-dc1-storage-04" = { vcpu = 8, mem = 24576, disk_gib = 550, macs = [ # Option C: 4th OSD host
      "52:54:01:d1:09:01", "52:54:01:d1:09:02", "52:54:01:d1:09:03",
      "52:54:01:d1:09:04", "52:54:01:d1:09:05", "52:54:01:d1:09:06",
    ] }
  }
}

module "vr1_dc1_node" {
  for_each = local.vr1_dc1_nodes

  source          = "../modules/node-vm"
  vm_name         = each.key
  autostart       = false # D-127: node VMs are MAAS-power-controlled -- MANUAL, never on host boot
  vcpu            = each.value.vcpu
  memory_mib      = each.value.mem
  disk_size_bytes = each.value.disk_gib * 1024 * 1024 * 1024
  pool_name       = module.inner_storage.pool_name
  network_names   = local.vr1_dc1_node_nics
  interface_macs  = each.value.macs # pinned FROM THE FIRST APPLY -- see the scheme comment
}