#cloud-config
hostname: ${hostname}
fqdn: ${fqdn}
prefer_fqdn_over_hostname: true

write_files:
%{ if vpn != null ~}
  - path: /etc/wireguard/wg0.conf
    permissions: "0600"
    content: |
      [Interface]
      Address = ${vpn.address}
      ListenPort = ${vpn.port}
      PrivateKey = ${vpn.private_key}
      # source lab traffic from the /31: the router only learns the loopback and vpc once ospf is up
      Table = off
%{ for r in vpn.routes ~}
      PostUp = ip route replace ${r} dev wg0 src ${vpn.src}
%{ endfor ~}

      [Peer]
      PublicKey = ${vpn.router_key}
      Endpoint = ${vpn.router}
      AllowedIPs = ${vpn.allowed_ips}
      PersistentKeepalive = 25
  - path: /etc/NetworkManager/system-connections/dum0.nmconnection
    permissions: "0600"
    content: |
      [connection]
      id=dum0
      type=dummy
      interface-name=dum0

      [ipv4]
      method=manual
      address1=${vpn.loopback}

      [ipv6]
      method=disabled
  - path: /etc/sysctl.d/90-ip-forward.conf
    content: |
      net.ipv4.ip_forward = 1
%{ endif ~}
  - path: /usr/local/sbin/lab-bootstrap
    permissions: "0755"
    content: |
      #!/bin/bash
      set -euo pipefail
      if ! rpm -q openvox-agent >/dev/null; then
        rpm -q openvox7-release >/dev/null || dnf install -y https://yum.voxpupuli.org/openvox7-release-el-9.noarch.rpm
        dnf install -y openvox-agent
      fi
      /opt/puppetlabs/bin/puppet config set --section main certname ${fqdn}
      /opt/puppetlabs/bin/puppet config set --section main server puppet.k8s.syd1.au.unkin.net
      /opt/puppetlabs/bin/puppet config set --section main ca_server puppetca.k8s.syd1.au.unkin.net
      /opt/puppetlabs/bin/puppet config set --section main report_server puppet.k8s.syd1.au.unkin.net
      /opt/puppetlabs/bin/puppet config set --section main environment production
%{ if vpn != null ~}
      rpm -q wireguard-tools >/dev/null || dnf install -y wireguard-tools
      sysctl -p /etc/sysctl.d/90-ip-forward.conf
      nmcli connection reload
      nmcli connection up dum0
      systemctl enable --now wg-quick@wg0
      wg show wg0 latest-handshakes | awk '$2 > 0 { ok = 1 } END { exit !ok }'
%{ endif ~}
%{ if routes != null ~}
      if ! ip route show 198.18.200.3 | grep -q .; then
        dev=$(ip -o -4 addr show to ${routes.vpc} | awk '{ print $2; exit }')
        con=$(nmcli -g GENERAL.CONNECTION device show "$dev")
        nmcli connection modify "$con" ipv4.routes "${routes.list}"
        nmcli device reapply "$dev"
      fi
%{ endif ~}
      timeout 5 bash -c '</dev/tcp/198.18.200.3/8140'
      printf '[main]\ndns=none\n' > /etc/NetworkManager/conf.d/90-dns-none.conf
      nmcli general reload
      rm -f /etc/resolv.conf
      printf 'search main.unkin.net\nnameserver 198.18.200.7\n' > /etc/resolv.conf
      systemctl enable --now puppet
      systemctl disable lab-bootstrap
  - path: /etc/systemd/system/lab-bootstrap.service
    content: |
      [Unit]
      Description=Install openvox, wait for the lab via the vpn host, then switch to internal DNS and start puppet
      Wants=network-online.target
      After=network-online.target
      StartLimitIntervalSec=0

      [Service]
      Type=oneshot
      ExecStart=/usr/local/sbin/lab-bootstrap
      Restart=on-failure
      RestartSec=30

      [Install]
      WantedBy=multi-user.target

runcmd:
  - systemctl daemon-reload
  - systemctl enable --now --no-block lab-bootstrap