#cloud-config
#
# Example: install and configure vpn-router during first boot.
#
# This is one way to reach the state described in README.md, not an interface
# the package depends on. It writes the configuration file directly, which
# keeps everything in one place and works the same whether or not debconf is
# involved.
#
# Template variables are Terraform templatefile() placeholders. Adapt or drop
# them for whatever renders this file.

hostname: ${hostname}
fqdn: ${fqdn}
manage_etc_hosts: false

apt:
  sources:
    vpn-router:
      source: "deb [signed-by=/etc/apt/keyrings/vpn-router.gpg] ${repo_url} ${ubuntu_codename} main"
      key: |
        ${indent(8, trimspace(repo_gpg_key))}

write_files:
  # The configuration file. Created here before the package is installed, so
  # postinst leaves it alone.
  - path: /etc/vpn-router/vpn-router.conf
    permissions: '0600'
    owner: root:root
    content: |
      [general]
      platform = ${platform}

      [interfaces]
      external = ${external_interface}
      internal = ${internal_interface}

      [wan]
      local_fqdn = ${fqdn}
      local_id_mode = ${local_id_mode}

      [local]
      cidrs = ${local_cidrs}
      int_gateway_ip = ${int_gateway_ip}

      [remote]
      addrs = ${remote_addrs}
      id = ${remote_id}
      cidrs = ${remote_cidrs}
      psk_b64 = ${psk_b64}

      [p2s]
      enabled = ${p2s_enabled}
      address_pool = ${p2s_address_pool}
      ca_name = ${p2s_ca_name}

      [wireguard]
      enabled = ${wg_enabled}
      address = ${wg_address}
      listen_port = ${wg_listen_port}

  # Optional: supply your own PKI instead of letting the package create a CA.
  # Remove these three entries to have a local CA generated on first boot.
  # <label> is the first component of the FQDN, for example "router" in
  # router.example.com.
  - path: /etc/vpn-router/pki/ca_cert.pem
    permissions: '0644'
    owner: root:root
    content: |
      ${indent(6, trimspace(ca_cert))}
  - path: /etc/vpn-router/pki/${label}_cert.pem
    permissions: '0644'
    owner: root:root
    content: |
      ${indent(6, trimspace(server_cert))}
  - path: /etc/vpn-router/pki/${label}_key.pem
    permissions: '0600'
    owner: root:root
    content: |
      ${indent(6, trimspace(server_key))}

package_update: true

packages:
  - vpn-router

# Nothing further is required: installing the package starts
# vpn-router-setup, which applies the configuration written above.