diff --git a/README.md b/README.md
index a6267e0..3bbceac 100644
--- a/README.md
+++ b/README.md
@@ -23,9 +23,9 @@ role in terraform-vault.
 
 ## Mail edge
 
-Each DMZ VPC (`bne` 172.18.32.0/24, `mel` 172.18.31.0/24) holds a postfix edge host and a vpn host. The vpn
+Each DMZ VPC (`syd` 172.18.30.0/24, `bne` 172.18.32.0/24, `mel` 172.18.31.0/24; mel is gated off until BinaryLane has stock) holds a postfix edge host and a vpn host. The vpn
 host runs wg0 as a /31 point-to-point link to its own prodnxsr0020 interface
-(`wg-bne` on 51821, `wg-mel` on 51822; `router_links` output) and forwards the
+(`wg-syd` on 51821, `wg-bne` on 51822, `wg-mel` on 51823; `router_links` output) and forwards the
 lab routes for its VPC; the edge host reaches the lab through it and has no
 WireGuard. Link /31s and vpn loopbacks (dum0) come from 198.18.2.160/27. Lab
 traffic is sourced from the /31 until Puppet brings up FRR, which peers OSPF
diff --git a/modules/binarylane/main.tf b/modules/binarylane/main.tf
index 6e2db09..8e08b4e 100644
--- a/modules/binarylane/main.tf
+++ b/modules/binarylane/main.tf
@@ -14,22 +14,25 @@ locals {
   ospf_allspf = "224.0.0.5/32"
 
   vpcs = {
-    bne = "172.18.32.0/24"
+    syd = "172.18.30.0/24"
     mel = "172.18.31.0/24"
+    bne = "172.18.32.0/24"
   }
 
   vpns = {
-    aubne1nxvm2131 = { region = "bne", vpc_ip = "172.18.32.11", router_port = 51821, router_address = "198.18.2.176", wg_address = "198.18.2.177", loopback = "198.18.2.161" }
-    aumel1nxvm2133 = { region = "mel", vpc_ip = "172.18.31.11", router_port = 51822, router_address = "198.18.2.178", wg_address = "198.18.2.179", loopback = "198.18.2.162" }
+    ausyd2nxvm2131 = { region = "syd", vpc_ip = "172.18.30.11", router_port = 51821, router_address = "198.18.2.176", wg_address = "198.18.2.177", loopback = "198.18.2.161" }
+    aumel1nxvm2133 = { region = "mel", vpc_ip = "172.18.31.11", router_port = 51823, router_address = "198.18.2.180", wg_address = "198.18.2.181", loopback = "198.18.2.163" }
+    aubne1nxvm2133 = { region = "bne", vpc_ip = "172.18.32.11", router_port = 51822, router_address = "198.18.2.178", wg_address = "198.18.2.179", loopback = "198.18.2.162" }
   }
 
   edges = {
-    aubne1nxvm2130 = { region = "bne", vpc_ip = "172.18.32.10", vpn = "aubne1nxvm2131", ptr = "mta1.edge.unkin.net" }
+    ausyd2nxvm2130 = { region = "syd", vpc_ip = "172.18.30.10", vpn = "ausyd2nxvm2131", ptr = "mta1.edge.unkin.net" }
     aumel1nxvm2132 = { region = "mel", vpc_ip = "172.18.31.10", vpn = "aumel1nxvm2133", ptr = "mta2.edge.unkin.net" }
+    aubne1nxvm2132 = { region = "bne", vpc_ip = "172.18.32.10", vpn = "aubne1nxvm2133", ptr = "mta2.edge.unkin.net" }
   }
 
   # regions whose servers are built; mel is out of stock at BinaryLane
-  enabled_regions = ["bne"]
+  enabled_regions = ["syd", "bne"]
   enabled_vpns    = { for k, v in local.vpns : k => v if contains(local.enabled_regions, v.region) }
   enabled_edges   = { for k, v in local.edges : k => v if contains(local.enabled_regions, v.region) }
 }
@@ -119,7 +122,8 @@ resource "binarylane_server" "vpn" {
 
   # user_data/image changes reinstall the server in place, wiping its disk
   lifecycle {
-    ignore_changes = [user_data, image]
+    ignore_changes  = [user_data, image]
+    prevent_destroy = true
   }
 }
 
@@ -151,7 +155,8 @@ resource "binarylane_server" "edge" {
 
   # user_data/image changes reinstall the server in place, wiping its disk
   lifecycle {
-    ignore_changes = [user_data, image]
+    ignore_changes  = [user_data, image]
+    prevent_destroy = true
   }
 }