accesspoints: added toggle to disable public wifi

also disabled public wifi on ANS till offloader works

.gitignore

@@ -1,2 +1,3 @@
 ansible-facts.json/
+switch-configs-stock/
 *.html

ansible-inventory

@@ -7,6 +7,15 @@ ap-c495 ip=10.84.1.34 location=tent-3          channel_2g=1  channel_5g=48
 ap-2bbf ip=10.84.1.30 location=tent-4          channel_2g=11 channel_5g=149
 ap-1a38 ip=10.84.1.35 location=tent-5          channel_2g=6  channel_5g=153
 ap-8f39 ip=10.84.1.37 location=tent-5          channel_2g=1  channel_5g=157
+ap-b62f ip=10.85.1.31 location=tent-1
+ap-b656 ip=10.85.1.35 location=tent-1
+ap-b6ee ip=10.85.1.32 location=office-security
+ap-b5df ip=10.85.1.38 location=office-social
+ap-b6cb ip=10.85.1.33 location=office-facility
+#ap-b641 ip=10.85.1.30 location=unknown
+#ap-b6d7 ip=10.85.1.34 location=unknown
+#ap-b644 ip=10.85.1.36 location=unknown
+#ap-b634 ip=10.85.1.37 location=unknown
 
 [accesspoints:vars]
 ansible_remote_tmp=/tmp
@@ -17,8 +26,14 @@ garet_release=845a6ba
 sw-access01 ip=10.84.1.11 base_mac=bc:cf:4f:e3:bb:8d
 sw-access02 ip=10.84.1.12 base_mac=bc:cf:4f:e3:ac:39
 
+[switches_stock]
+ffl-ans-sw-distribution01 ip=10.85.1.11 base_mac=5c:e2:8c:6a:7f:cc
+ffl-ans-sw-access01       ip=10.85.1.12 base_mac=d8:ec:e5:9b:46:50
+ffl-ans-sw-access02       ip=10.85.1.13 base_mac=d8:ec:e5:9b:45:a0
+
 [gateways]
-gw-core01 ip=10.84.1.1
+gw-core01         ip=10.84.1.1
+ffl-ans-gw-core01 ip=10.85.1.1
 
 [gateways:vars]
 ansible_remote_tmp=/tmp
@@ -41,3 +56,49 @@ ostemplate=local:vztmpl/debian-11-standard_11.3-1_amd64.tar.zst
 
 [openwrt:children]
 switches
+
+[site_adp]
+ap-c5d1
+ap-ac7c
+ap-8f42
+ap-0b99
+ap-c495
+ap-2bbf
+ap-1a38
+ap-8f39
+sw-access01
+sw-access02
+gw-core01
+hyper01
+monitoring01
+mon-e2e-clients01
+mon-e2e-wan01
+
+[site_adp:vars]
+wifi_ssid="GU Deutscher Platz"
+wifi_encryption=none
+backoffice_wifi_ssid="GU Deutscher Platz Backoffice"
+backoffice_wifi_encryption=psk2
+backoffice_wifi_psk="{{ lookup('passwordstore', 'wifi/GU_Deutscher_Platz_Backoffice') }}"
+
+[site_ans]
+ap-b641
+ap-b62f
+ap-b6ee
+ap-b6cb
+ap-b6d7
+ap-b656
+ap-b644
+ap-b634
+ap-b5df
+ffl-ans-sw-distribution01
+ffl-ans-sw-access01
+ffl-ans-sw-access02
+
+[site_ans:vars]
+wifi_ssid="GU Arno-Nitzsche-Strasse"
+wifi_encryption=none
+wifi_disabled=1
+backoffice_wifi_ssid="GU Arno-Nitzsche-Strasse Backoffice"
+backoffice_wifi_encryption=psk2
+backoffice_wifi_psk="{{ lookup('passwordstore', 'wifi/GU_Arno-Nitzsche-Straße_Backoffice') }}"

files/ospfd.conf

@@ -28,4 +28,7 @@ area 0.0.0.0 {
 	interface wg0 {
 		type p2p
 	}
+	interface wg2 {
+		type p2p
+	}
 }

files/pf.wg2.conf

@@ -0,0 +1,8 @@
+# allow incoming udp packets for wg2
+pass in proto udp from any to self port 51822
+
+# allow ospf on wg2
+pass on wg2 proto ospf
+
+# allow prometheus on wg2
+pass on wg2 proto tcp from any to self port 9100

playbook_create_switch_configs_stock.yml

@@ -0,0 +1,16 @@
+---
+- name: generate configuration for stock firmware
+  hosts:
+    - switches_stock
+  gather_facts: no
+  connection: local
+  tasks:
+    - name: create output directory
+      file:
+        state: directory
+        path: switch-configs-stock/
+
+    - name: generate configuration
+      template:
+        src: templates/gs1900-10hp-stock.cfg.j2
+        dest: "switch-configs-stock/{{ inventory_hostname }}.cfg"

playbook_provision_accesspoints.yml

@@ -2,9 +2,6 @@
 - name: provision aps
   hosts: accesspoints
   gather_facts: no
-  vars:
-    - wifi_ssid: "GU Deutscher Platz"
-    - wifi_encryption: "none"
   tasks:
     - name: provision /etc/config
       template:

playbook_provision_backbone.yml

@@ -2,26 +2,32 @@
 - name: configure tunnel on eae-adp-jump01
   hosts: eae-adp-jump01
   tasks:
-    - name: create wg0 interface file
+    - name: create wgX interface files
       template:
-        src: templates/hostname.wg0
-        dest: /etc/hostname.wg0
+        src: "{{ item }}"
+        dest: /etc/
         mode: 0600
+      with_fileglob:
+        - "templates/hostname.wg*"
       notify:
         - reload interfaces
 
-    - name: create pf.wg0.conf file
+    - name: create pf.wgX.conf files
       copy:
-        src: files/pf.wg0.conf
-        dest: /etc/pf.wg0.conf
+        src: "{{ item }}"
+        dest: /etc/
         mode: 0600
+      with_fileglob:
+        - "files/pf.wg*.conf"
       notify:
         - reload firewall
 
-    - name: include pf.wg0.conf in pf.include.conf
+    - name: include pf.wgX.conf in pf.include.conf
       lineinfile:
         path: /etc/pf.include.conf
-        line: 'include "/etc/pf.wg0.conf"'
+        line: 'include "/etc/{{ item | basename }}"'
+      with_fileglob:
+        - "files/pf.wg*.conf"
       notify:
         - reload firewall
 
@@ -50,4 +56,4 @@
     - name: restart ospfd
       service:
         name: ospfd
-        state: restart
+        state: restarted

playbook_provision_eae-adp-jump01.yml

@@ -21,8 +21,8 @@
     - name: activate routing
       blockinfile:
         content: |
-          net.inet.ip.forwarding=0
-          net.inet6.ip6.forwarding=0
+          net.inet.ip.forwarding=1
+          net.inet6.ip6.forwarding=1
         path: /etc/sysctl.conf
         mode: 0600
         create: yes

playbook_provision_gateway.yml

@@ -4,11 +4,13 @@
   tasks:
     - name: configure routing tables
       copy:
-        src: templates/gateways/etc/iproute2/rt_tables
-        dest: /etc/iproute2/rt_tables
+        src: "{{ item }}"
+        dest: /etc/iproute2/
         owner: root
         group: root
         mode: 0644
+      with_fileglob:
+        - "templates/gateways/{{ inventory_hostname }}/etc/iproute2/*"
       notify:
         - reload network
 
@@ -20,7 +22,7 @@
         group: root
         mode: 0600
       with_fileglob:
-        - "templates/gateways/etc/config/*"
+        - "templates/gateways/{{ inventory_hostname }}/etc/config/*"
       notify:
         - "reload {{ item | basename }}"
 
@@ -32,7 +34,7 @@
         group: root
         mode: 0600
       with_fileglob:
-        - "templates/gateways/etc/frr/*"
+        - "templates/gateways/{{ inventory_hostname }}/etc/frr/*"
       notify:
         - restart frr
 

templates/accesspoints/etc/config/wireless

@@ -20,14 +20,15 @@ config wifi-iface 'default_radio0'
 {% if wifi_psk is defined %}
         option key '{{ wifi_psk }}'
 {% endif %}
+        option disabled '{{ wifi_disabled | default(0) }}'
 
 config wifi-iface 'backoffice_radio0'
         option device 'radio0'
         option network 'backoffice'
         option mode 'ap'
-        option ssid 'GU Deutscher Platz Backoffice'
-        option encryption 'psk2'
-        option key "{{ lookup('passwordstore', 'wifi/GU_Deutscher_Platz_Backoffice') }}"
+        option ssid '{{ backoffice_wifi_ssid }}'
+        option encryption '{{ backoffice_wifi_encryption }}'
+        option key '{{ backoffice_wifi_psk }}'
 {% if location not in ['office-facility', 'office-social'] %}
         option disabled '1'
 {% endif %}
@@ -53,14 +54,15 @@ config wifi-iface 'default_radio1'
 {% if wifi_psk is defined %}
         option key '{{ wifi_psk }}'
 {% endif %}
+        option disabled '{{ wifi_disabled | default(0) }}'
 
 config wifi-iface 'backoffice_radio1'
         option device 'radio1'
         option network 'backoffice'
         option mode 'ap'
-        option ssid 'GU Deutscher Platz Backoffice'
-        option encryption 'psk2'
-        option key "{{ lookup('passwordstore', 'wifi/GU_Deutscher_Platz_Backoffice') }}"
+        option ssid '{{ backoffice_wifi_ssid }}'
+        option encryption '{{ backoffice_wifi_encryption }}'
+        option key '{{ backoffice_wifi_psk }}'
 {% if location not in ['office-facility', 'office-social'] %}
         option disabled '1'
 {% endif %}

templates/gateways/ffl-ans-gw-core01/etc/config/dhcp

@@ -0,0 +1,53 @@
+
+config dnsmasq
+	option domainneeded '1'
+	option boguspriv '1'
+	option filterwin2k '0'
+	option localise_queries '1'
+	option rebind_protection '0'
+	option rebind_localhost '1'
+	option local '/lan/'
+	option domain 'lan'
+	option expandhosts '1'
+	option nonegcache '0'
+	option authoritative '1'
+	option readethers '1'
+	option leasefile '/etc/dhcp.leases'
+	option resolvfile '/tmp/resolv.conf.d/resolv.conf.auto'
+	option nonwildcard '1'
+	option localservice '1'
+	option ednspacket_max '1232'
+
+config dhcp 'mgmt'
+	option interface 'mgmt'
+	option start '100'
+	option limit '150'
+	option leasetime '12h'
+	option dhcpv4 'server'
+	option dhcpv6 'server'
+	option ra 'server'
+	option ra_slaac '1'
+	list ra_flags 'managed-config'
+	list ra_flags 'other-config'
+
+config dhcp 'backoffice'
+	option interface 'backoffice'
+	option start '100'
+	option limit '150'
+	option leasetime '12h'
+	option dhcpv4 'server'
+	option dhcpv6 'server'
+	option ra 'server'
+	option ra_slaac '1'
+	list ra_flags 'managed-config'
+	list ra_flags 'other-config'
+
+config dhcp 'wan'
+	option interface 'wan'
+	option ignore '1'
+
+config odhcpd 'odhcpd'
+	option maindhcp '0'
+	option leasefile '/tmp/hosts/odhcpd'
+	option leasetrigger '/usr/sbin/odhcpd-update'
+	option loglevel '4'

templates/gateways/ffl-ans-gw-core01/etc/config/firewall

@@ -0,0 +1,312 @@
+config defaults
+	option syn_flood	1
+	option input		REJECT
+	option output		ACCEPT
+	option forward		REJECT
+# Uncomment this line to disable ipv6 rules
+#	option disable_ipv6	1
+
+config zone
+	option name		mgmt
+	list   network		'mgmt'
+	option input		ACCEPT
+	option output		ACCEPT
+	option forward		REJECT
+
+config zone
+	option name		backoffice
+	list   network		'backoffice'
+	option input		REJECT
+	option output		ACCEPT
+	option forward		REJECT
+
+config zone
+	option name		backbone
+	list network		wg2
+	option input		REJECT
+	option output 		ACCEPT
+	option forward		REJECT
+
+config zone
+	option name		wan
+	list   network		'wan'
+	list   network		'wan6'
+	option input		REJECT
+	option output		ACCEPT
+	option forward		REJECT
+	option masq		1
+	option mtu_fix		1
+
+config forwarding
+	option src		mgmt
+	option dest		wan
+
+config forwarding
+	option src		backoffice
+	option dest		wan
+
+config rule
+	option name		From-BACKBONE-Allow-OSPF
+	option src		backbone
+	option proto		ospf
+	option target		ACCEPT
+
+config rule
+	option name		From-Any-Allow-SSH
+	option src		*
+	option proto		tcp
+	option dest_port	22
+	option target		ACCEPT
+
+config rule
+	option name		Into-MGMT-Allow-SSH
+	option src		*
+	option dest		mgmt
+	option proto		tcp
+	option dest_port	22
+	option target		ACCEPT
+
+config rule
+	option name		Into-MGMT-Allow-ICMP
+	option src		*
+	option dest		mgmt
+	option proto		icmp
+	option target		ACCEPT
+
+config rule
+	option name		Into-MGMT-Allow-Prometheus
+	option src		*
+	option dest		mgmt
+	option proto		tcp
+	option dest_port	9100
+	option target		ACCEPT
+
+config rule
+	option name		From-MGMT-Into-BACKBONE-Allow-Prometheus
+	option src		mgmt
+	option dest		backbone
+	option proto		tcp
+	option dest_port	9100
+	option target		ACCEPT
+
+config rule
+	option name		Into-MGMT-Allow-Prometheus-WebGUI-On-monitoring01
+	option src		*
+	option dest		mgmt
+	option proto		tcp
+	option dest_ip		10.84.1.51
+	option dest_port	9090
+	option target		ACCEPT
+
+config rule
+	option name		Into-MGMT-Allow-Grafana-WebGUI-On-monitoring01
+	option src		*
+	option dest		mgmt
+	option proto		tcp
+	option dest_ip		10.84.1.51
+	option dest_port	3000
+	option target		ACCEPT
+
+# We need to accept udp packets on port 68,
+# see https://dev.openwrt.org/ticket/4108
+config rule
+	option name		Allow-DHCP-Renew
+	option src		wan
+	option proto		udp
+	option dest_port	68
+	option target		ACCEPT
+	option family		ipv4
+
+# Allow IPv4 ping
+config rule
+	option name		Allow-Ping
+	option src		*
+	option proto		icmp
+	option icmp_type	echo-request
+	option family		ipv4
+	option target		ACCEPT
+
+config rule
+	option name		Allow-IGMP
+	option src		wan
+	option proto		igmp
+	option family		ipv4
+	option target		ACCEPT
+
+# Allow DHCPv6 replies
+# see https://dev.openwrt.org/ticket/10381
+config rule
+	option name		Allow-DHCPv6
+	option src		wan
+	option proto		udp
+	option src_ip		fc00::/6
+	option dest_ip		fc00::/6
+	option dest_port	546
+	option family		ipv6
+	option target		ACCEPT
+
+config rule
+	option name		Allow-MLD
+	option src		wan
+	option proto		icmp
+	option src_ip		fe80::/10
+	list icmp_type		'130/0'
+	list icmp_type		'131/0'
+	list icmp_type		'132/0'
+	list icmp_type		'143/0'
+	option family		ipv6
+	option target		ACCEPT
+
+# Allow essential incoming IPv6 ICMP traffic
+config rule
+	option name		Allow-ICMPv6-Input
+	option src		wan
+	option proto	icmp
+	list icmp_type		echo-request
+	list icmp_type		echo-reply
+	list icmp_type		destination-unreachable
+	list icmp_type		packet-too-big
+	list icmp_type		time-exceeded
+	list icmp_type		bad-header
+	list icmp_type		unknown-header-type
+	list icmp_type		router-solicitation
+	list icmp_type		neighbour-solicitation
+	list icmp_type		router-advertisement
+	list icmp_type		neighbour-advertisement
+	option limit		1000/sec
+	option family		ipv6
+	option target		ACCEPT
+
+# Allow essential forwarded IPv6 ICMP traffic
+config rule
+	option name		Allow-ICMPv6-Forward
+	option src		wan
+	option dest		*
+	option proto		icmp
+	list icmp_type		echo-request
+	list icmp_type		echo-reply
+	list icmp_type		destination-unreachable
+	list icmp_type		packet-too-big
+	list icmp_type		time-exceeded
+	list icmp_type		bad-header
+	list icmp_type		unknown-header-type
+	option limit		1000/sec
+	option family		ipv6
+	option target		ACCEPT
+
+config rule
+	option name		Allow-IPSec-ESP
+	option src		wan
+	option dest		backoffice
+	option proto		esp
+	option target		ACCEPT
+
+config rule
+	option name		Allow-ISAKMP
+	option src		wan
+	option dest		backoffice
+	option dest_port	500
+	option proto		udp
+	option target		ACCEPT
+
+config rule
+	option name		WAN_Allow-SSH
+	option src		wan
+	option dest_port	22
+	option proto		tcp
+	option target		ACCEPT
+
+# allow interoperability with traceroute classic
+# note that traceroute uses a fixed port range, and depends on getting
+# back ICMP Unreachables.  if we're operating in DROP mode, it won't
+# work so we explicitly REJECT packets on these ports.
+config rule
+	option name		Support-UDP-Traceroute
+	option src		wan
+	option dest_port	33434:33689
+	option proto		udp
+	option family		ipv4
+	option target		REJECT
+	option enabled		false
+
+config rule
+	option name		BACKOFFICE_Allow-DHCP
+	option src		backoffice
+	option proto		udp
+	option dest_port	67-68
+	option target		ACCEPT
+	option family		ipv4
+
+config rule
+	option name		BACKOFFICE_Allow-DNS
+	option src		backoffice
+	option proto		udp
+	option dest_port	53
+	option target		ACCEPT
+	option family		ipv4
+
+
+# include a file with users custom iptables rules
+config include
+	option path /etc/firewall.user
+
+
+### EXAMPLE CONFIG SECTIONS
+# do not allow a specific ip to access wan
+#config rule
+#	option src		mgmt
+#	option src_ip	192.168.45.2
+#	option dest		wan
+#	option proto	tcp
+#	option target	REJECT
+
+# block a specific mac on wan
+#config rule
+#	option dest		wan
+#	option src_mac	00:11:22:33:44:66
+#	option target	REJECT
+
+# block incoming ICMP traffic on a zone
+#config rule
+#	option src		mgmt
+#	option proto	ICMP
+#	option target	DROP
+
+# port redirect port coming in on wan to lan
+#config redirect
+#	option src			wan
+#	option src_dport	80
+#	option dest			lan
+#	option dest_ip		192.168.16.235
+#	option dest_port	80
+#	option proto		tcp
+
+# port redirect of remapped ssh port (22001) on wan
+#config redirect
+#	option src		wan
+#	option src_dport	22001
+#	option dest		lan
+#	option dest_port	22
+#	option proto		tcp
+
+### FULL CONFIG SECTIONS
+#config rule
+#	option src		lan
+#	option src_ip	192.168.45.2
+#	option src_mac	00:11:22:33:44:55
+#	option src_port	80
+#	option dest		wan
+#	option dest_ip	194.25.2.129
+#	option dest_port	120
+#	option proto	tcp
+#	option target	REJECT
+
+#config redirect
+#	option src		lan
+#	option src_ip	192.168.45.2
+#	option src_mac	00:11:22:33:44:55
+#	option src_port		1024
+#	option src_dport	80
+#	option dest_ip	194.25.2.129
+#	option dest_port	120
+#	option proto	tcp

templates/gateways/ffl-ans-gw-core01/etc/config/network

@@ -0,0 +1,84 @@
+
+config interface 'loopback'
+        option device 'lo'
+        option proto 'static'
+        option ipaddr '127.0.0.1'
+        option netmask '255.0.0.0'
+
+config globals 'globals'
+        option packet_steering '1'
+        option ula_prefix 'fd36:4280:eae3::/48'
+
+config device 'switch'
+        option name 'switch'
+        option type 'bridge'
+        option vlan_filtering 1
+        list ports 'eth0'
+        list ports 'eth1'
+        list ports 'eth2'
+        list ports 'eth3'
+
+config bridge-vlan 'mgmt_vlan'
+        option vlan '1'
+        option device 'switch'
+        list ports 'eth1:u*'
+        list ports 'eth2:u*'
+        list ports 'eth3:u*'
+
+config bridge-vlan 'clients_vlan'
+        option vlan '2'
+        option device 'switch'
+        list ports 'eth1:t'
+        list ports 'eth2:t'
+        list ports 'eth3:t'
+
+config bridge-vlan 'wan_vlan'
+        option vlan '3'
+        option device 'switch'
+        list ports 'eth0:u*'
+        list ports 'eth1:t'
+        list ports 'eth2:t'
+        list ports 'eth3:t'
+
+config bridge-vlan 'backoffice_vlan'
+        option vlan '8'
+        option device 'switch'
+        list ports 'eth1:t'
+        list ports 'eth2:t'
+        list ports 'eth3:t'
+
+config interface 'mgmt'
+        option device 'switch.1'
+        option proto 'static'
+        option ipaddr '10.85.1.1'
+        option netmask '255.255.255.0'
+
+config interface 'wan'
+        option device 'switch.3'
+        option proto 'dhcp'
+
+config interface 'wan6'
+        option device 'switch.3'
+        option proto 'dhcpv6'
+
+config interface 'backoffice'
+        option device 'switch.8'
+        option proto 'static'
+        option ipaddr '10.85.8.1'
+        option netmask '255.255.255.0'
+
+config interface 'wg2'
+        option proto 'wireguard'
+        option private_key "{{ lookup('passwordstore', 'wg/wg2/{{ inventory_hostname }}') }}"
+        option listen_port 51822
+        option mtu 1350
+        list addresses '10.85.254.1/31'
+
+config wireguard_wg2 'eap_adp_jump01'
+        option public_key "{{ lookup('passwordstore', 'wg/wg2/eae-adp-jump01.pub') }}"
+        option preshared_key "{{ lookup('passwordstore', 'wg/wg2/psk') }}"
+        option endpoint_host '162.55.53.85'
+        option endpoint_port '51822'
+        option route_allowed_ips '0'
+        option persistent_keepalive 15
+        list allowed_ips '0.0.0.0/0'

templates/gateways/ffl-ans-gw-core01/etc/config/system

@@ -0,0 +1,16 @@
+
+config system
+	option hostname '{{ inventory_hostname }}'
+	option timezone 'CET-1CEST,M3.5.0,M10.5.0/3' # Europe/Berlin
+	option ttylogin '0'
+	option log_size '64'
+	option urandom_seed '0'
+	option compat_version '1.1'
+
+config timeserver 'ntp'
+	option enabled '1'
+	option enable_server '0'
+	list server '0.openwrt.pool.ntp.org'
+	list server '1.openwrt.pool.ntp.org'
+	list server '2.openwrt.pool.ntp.org'
+	list server '3.openwrt.pool.ntp.org'

templates/gateways/ffl-ans-gw-core01/etc/frr/frr.conf

@@ -0,0 +1,16 @@
+password zebra
+!
+router ospf
+  redistribute connected
+!
+log syslog
+!
+interface wg2
+  ip ospf area 0
+  ip ospf network point-to-point
+!
+access-list vty permit 127.0.0.0/8
+access-list vty deny any
+!
+line vty
+ access-class vty

templates/gateways/gw-core01/etc/config/prometheus-node-exporter-lua

@@ -0,0 +1,4 @@
+config prometheus-node-exporter-lua 'main'
+	option listen_interface 'mgmt'
+	option listen_ipv6 '0'
+	option listen_port '9100'

templates/gateways/gw-core01/etc/frr/daemons

@@ -0,0 +1,54 @@
+# The staticd,watchfrr and zebra daemons are always started.
+#
+bgpd=no
+ospfd=yes
+#ospfd_instances=1,20
+ospf6d=no
+ripd=no
+ripngd=no
+isisd=no
+pimd=no
+ldpd=no
+nhrpd=no
+eigrpd=no
+babeld=no
+sharpd=no
+pbrd=no
+bfdd=no
+fabricd=no
+vrrpd=no
+
+#
+# If this option is set the /etc/init.d/frr script automatically loads
+# the config via "vtysh -b" when the servers are started.
+# Check /etc/pam.d/frr if you intend to use "vtysh"!
+#
+vtysh_enable=yes
+zebra_options="  -A 127.0.0.1 -s 90000000"
+bgpd_options="   -A 127.0.0.1"
+ospfd_options="  -A 127.0.0.1"
+ospf6d_options=" -A ::1"
+ripd_options="   -A 127.0.0.1"
+ripngd_options=" -A ::1"
+isisd_options="  -A 127.0.0.1"
+pimd_options="   -A 127.0.0.1"
+ldpd_options="   -A 127.0.0.1"
+nhrpd_options="  -A 127.0.0.1"
+eigrpd_options=" -A 127.0.0.1"
+babeld_options=" -A 127.0.0.1"
+sharpd_options=" -A 127.0.0.1"
+pbrd_options="   -A 127.0.0.1"
+staticd_options="-A 127.0.0.1"
+bfdd_options="   -A 127.0.0.1"
+fabricd_options="-A 127.0.0.1"
+vrrpd_options="  -A 127.0.0.1"
+
+# The list of daemons to watch is automatically generated by the init script.
+#watchfrr_options=""
+
+# for debugging purposes, you can specify a "wrap" command to start instead
+# of starting the daemon directly, e.g. to use valgrind on ospfd:
+#   ospfd_wrap="/usr/bin/valgrind"
+# or you can use "all_wrap" for all daemons, e.g. to use perf record:
+#   all_wrap="/usr/bin/perf record --call-graph -"
+# the normal daemon command is added to this at the end.

templates/gs1900-10hp-stock.cfg.j2

@@ -0,0 +1,126 @@
+! System Description: ZyXEL GS1900-10HP Switch
+! Revision: 
+! Serial Number: 
+! MAC Address Range: 
+! Boot Version: 
+! Firmware Version: 
+! System Up Time: 
+!
+!
+!
+system name "{{ inventory_hostname }}"
+ip address {{ ip }} mask 255.255.255.0
+ip default-gateway 10.85.1.1
+ip dns 10.85.1.1 0.0.0.0
+username "admin" password {{ lookup('passwordstore', 'switches/{{ inventory_hostname }}') }}
+vlan 1
+ name "mgmt"
+vlan 2
+ name "clients"
+vlan 3
+ name "wan"
+vlan 8
+ name "backoffice"
+voice-vlan oui-table 00:E0:BB "3COM"
+voice-vlan oui-table 00:03:6B "Cisco"
+voice-vlan oui-table 00:E0:75 "Veritel"
+voice-vlan oui-table 00:D0:1E "Pingtel"
+voice-vlan oui-table 00:01:E3 "Siemens"
+voice-vlan oui-table 00:60:B9 "NEC/Philips"
+voice-vlan oui-table 00:0F:E2 "H3C"
+voice-vlan oui-table 00:09:6E "Avaya"
+!
+!
+!
+!
+!
+spanning-tree mst configuration
+ name "{{ base_mac }}"
+!
+!
+!
+no snmp community "public"
+snmp community "{{ lookup('passwordstore', 'snmp-community') }}"  ro
+!
+!
+ip ssh
+!
+!
+management access-list default
+!
+interface lag1
+ switchport hybrid ingress-filtering
+ switchport hybrid allowed vlan add 2-3,8 tagged
+!
+interface lag2
+ switchport hybrid ingress-filtering
+ switchport hybrid allowed vlan add 2-3,8 tagged
+!
+interface lag3
+ switchport hybrid ingress-filtering
+ switchport hybrid allowed vlan add 2-3,8 tagged
+!
+interface lag4
+ switchport hybrid ingress-filtering
+ switchport hybrid allowed vlan add 2-3,8 tagged
+!
+interface lag5
+ switchport hybrid ingress-filtering
+ switchport hybrid allowed vlan add 2-3,8 tagged
+!
+interface lag6
+ switchport hybrid ingress-filtering
+ switchport hybrid allowed vlan add 2-3,8 tagged
+!
+interface lag7
+ switchport hybrid ingress-filtering
+ switchport hybrid allowed vlan add 2-3,8 tagged
+!
+interface lag8
+ switchport hybrid ingress-filtering
+ switchport hybrid allowed vlan add 2-3,8 tagged
+!
+interface 1
+ switchport hybrid ingress-filtering
+ switchport hybrid allowed vlan add 2-3,8 tagged
+!
+interface 2
+ switchport hybrid ingress-filtering
+ switchport hybrid allowed vlan add 2-3,8 tagged
+!
+interface 3
+ switchport hybrid ingress-filtering
+ switchport hybrid allowed vlan add 2-3,8 tagged
+!
+interface 4
+ switchport hybrid ingress-filtering
+ switchport hybrid allowed vlan add 2-3,8 tagged
+!
+interface 5
+ switchport hybrid ingress-filtering
+ switchport hybrid allowed vlan add 2-3,8 tagged
+!
+interface 6
+ switchport hybrid ingress-filtering
+ switchport hybrid allowed vlan add 2-3,8 tagged
+!
+interface 7
+ switchport hybrid ingress-filtering
+ switchport hybrid allowed vlan add 2-3,8 tagged
+!
+interface 8
+ switchport hybrid ingress-filtering
+ switchport hybrid allowed vlan add 2-3,8 tagged
+!
+interface 9
+ switchport hybrid ingress-filtering
+ switchport hybrid allowed vlan add 2-3,8 tagged
+!
+interface 10
+ switchport hybrid ingress-filtering
+ switchport hybrid allowed vlan add 2-3,8 tagged
+!
+!
+!
+!
+

templates/hostname.wg2

@@ -0,0 +1,5 @@
+inet 10.85.254.0/31
+mtu 1350
+wgport 51822
+wgkey {{ lookup('passwordstore', 'wg/wg2/eae-adp-jump01') }}
+wgpeer {{ lookup('passwordstore', 'wg/wg2/ffl-ans-gw-core01.pub') }} wgpsk {{ lookup('passwordstore', 'wg/wg2/psk') }} wgaip 0.0.0.0/0