# A single-NIC desktop PC as the router ("router on a stick").
#
#   ISP -- ONT/modem -- switch/port --+-- eno1 (untagged)   LAN 192.168.10.0/24
#                                     +-- eno1.1001         PPPoE uplink (IPv4)
#
# The switch port the PC is plugged into must carry VLAN 1001 tagged (towards
# the ISP) and the LAN untagged. IPv6 is off: without a second link there is no
# untagged uplink for DHCPv6 to run on.
#
# Before the first deployment:
#   1. Replace the hardware section (`nixos-generate-config --show-hardware-config`).
#   2. Put your SSH public key below (otherwise nobody can log in over the network).
#   3. Put the PPPoE username below and the password in /var/lib/router/pppoe-password
#      (mode 0600, root); it is read at runtime and never enters the Nix store.
{ config, lib, ... }:
{
  # --- Hardware: replace with the generated configuration --------------------
  boot.loader.systemd-boot.enable = true;
  boot.loader.efi.canTouchEfiVariables = true;
  fileSystems."/" = {
    device = "/dev/disk/by-label/nixos";
    fsType = "ext4";
  };
  fileSystems."/boot" = {
    device = "/dev/disk/by-label/boot";
    fsType = "vfat";
  };
  # ---------------------------------------------------------------------------

  networking.hostName = "router";
  system.stateVersion = "25.11";

  users.users.root.openssh.authorizedKeys.keys = [
    "ssh-ed25519 AAAA-REPLACE-WITH-YOUR-PUBLIC-KEY you@workstation"
  ];
  warnings = lib.optional (lib.any (lib.hasInfix "REPLACE") config.users.users.root.openssh.authorizedKeys.keys) ''
    examples/desktop: the SSH key is still the placeholder; remote deployment will not work.
  '';

  router = {
    enable = true;

    wan = {
      interface = "eno1";
      ipv4 = {
        type = "pppoe";
        pppoe = {
          vlan = 1001;
          username = "CHANGE-ME@isp.example";
          passwordFile = "/var/lib/router/pppoe-password";
        };
      };
    };

    lans.main = {
      interface = "eno1";
      internet = true;
      ipv4.address = "192.168.10.1";
      dhcp.pool = {
        start = "192.168.10.100";
        end = "192.168.10.199";
      };
    };

    # A deployment that is not confirmed within this time is rolled back.
    rollback.timeout = "5min";
  };
}