# A single-NIC desktop PC as the router ("router on a stick").
#
#   ISP -- ONT/modem -- switch/port --+-- eno1 (untagged)   LAN 192.168.10.0/24
#                                     +-- eno1.1001         PPPoE uplink (IPv4)
#
# The switch port the PC is plugged into must carry VLAN 1001 tagged (towards
# the ISP) and the LAN untagged. IPv6 is off: without a second link there is no
# untagged uplink for DHCPv6 to run on.
#
# Before the first deployment:
#   1. Check the NIC name (`eno1`) with `ip link` on the target box. Disk layout and
#      drivers come from the installer layout, so no hardware scan is needed.
#   2. Put your SSH public key below (otherwise nobody can log in over the network).
#   3. Put the PPPoE username below and the password in /var/lib/router/pppoe-password
#      (mode 0600, root); it is read at runtime and never enters the Nix store.
{ config, lib, ... }:
{
  imports = [ ../../modules/installer/layout.nix ];

  # --- Hardware: generic UEFI PC. Disk layout and drivers come from the
  # installer's layout module; adjust only if you do not use `router-install`.

  networking.hostName = "router";
  system.stateVersion = "25.11";

  users.users.root.openssh.authorizedKeys.keys = [
    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHro2zo4L13P2ukShg3JFga5/LYOkKeoOrUiFRJN3j82 nstinnesbeck nils.stinnesbeck@t-systems.com"
  ];
  warnings = lib.optional (lib.any (lib.hasInfix "REPLACE") config.users.users.root.openssh.authorizedKeys.keys) ''
    examples/desktop: the SSH key is still the placeholder; remote deployment will not work.
  '';

  router = {
    enable = true;

    wan = {
      interface = "eno1";
      ipv4 = {
        type = "pppoe";
        pppoe = {
          vlan = 1001;
          username = "CHANGE-ME@isp.example";
          passwordFile = "/var/lib/router/pppoe-password";
        };
      };
    };

    lans.main = {
      interface = "eno1";
      internet = true;
      ipv4.address = "192.168.10.1";
      dhcp.pool = {
        start = "192.168.10.100";
        end = "192.168.10.199";
      };
    };

    # A deployment that is not confirmed within this time is rolled back.
    rollback.timeout = "5min";
  };
}