nodes['home.router'] = {
    'hostname': '172.19.138.1',
    'bundles': {
        'bird',
        'jool',
        'kea-dhcp-server',
        'nginx',
        'pppd',
        'radvd',
        'unbound',
        'vnstat',
        'wide-dhcp6c',
        'wireguard',
    },
    'groups': {
        'debian-bookworm',
    },
    'metadata': {
        'interfaces': {
            'enp1s0.1138': {
                'ips': {
                    '172.19.138.1/24',
                    'fe80::1/64',
                },
            },
            'enp1s0.1139': {
                'ips': {
                    '172.19.139.1/24',
                    'fe80::1/64',
                },
            },
        },
        'backups': {
            'exclude_from_backups': True,
        },
        'bird': {
            'static_routes': {
                '172.19.138.0/24',
                '172.19.139.0/24',
            },
        },
        'cron': {
            'jobs': {
                # Our internet provider resets the connection if you're
                # connected longer than 24 hours. We install this cronjob
                # to make sure we don't get disconnected randomly during the
                # day.
                'restart_pppd': r'23 2 * * *    root    systemctl restart pppoe && date -u +\%s > /var/tmp/pppd-last-restart.status',
            },
        },
        'kea-dhcp-server': {
            'subnets': {
                'enp1s0.1138': {
                    'lower':  '172.19.138.100',
                    'higher': '172.19.138.250',
                    'subnet': '172.19.138.0/24',
                    'options': {
                        'domain-name-servers': '172.19.138.1',
                        'routers': '172.19.138.1',
                    },
                },
                'enp1s0.1139': {
                    'lower':  '172.19.139.200',
                    'higher': '172.19.139.250',
                    'subnet': '172.19.139.0/24',
                    'options': {
                        'domain-name-servers': '172.19.139.1',
                        'routers': '172.19.139.1',
                    },
                },
            },
        },
        'icinga_options': {
            # override group default
            'also_affected_by': atomic(set()),
            # disabled on group level
            # XXX reenable this once we can leave the house safely again
            #'vars.notification.sms': True
        },
        'nftables': {
            'forward': {
                '50-router': [
                    'ct state { related, established } accept',
                    'iifname enp1s0.1138 accept',
                    'ip6 nexthdr ipv6-icmp accept',
                    'tcp dport 22 accept',
                ],
            },
            'prerouting': {
                '50-router': [
                    'tcp dport 2022 dnat 172.19.138.20:22',
                ],
            },
        },
        'nginx': {
            'restrict-to': {
                '172.19.136.0/25',
                '172.19.138.0/24',
                'htz-cloud.molly-connector',
            },
            'vhosts': {
                'vnstat': {
                    'domain': 'router.home.kunbox.net',
                    'ssl': '_.home.kunbox.net',
                },
            },
        },
        'radvd': {
            'interfaces': {
                'enp1s0.1138': {
                    'rdnss': {
                        'fe80::1',
                    },
                },
                'enp1s0.1139': {
                    'rdnss': {
                        'fe80::1',
                    },
                },
            },
        },
        'postfix': {
            'mynetworks': {
                '172.19.138.0/24',
            },
        },
        'pppd': {
            'username': vault.decrypt('encrypt$gAAAAABfruZ5AZbgJ3mfMLWqIMx8o4bBRMJsDPD1jElh-vWN_gnhiuZVjrQ1-7Y6zDXNkxXiyhx8rxc2enmvo26axd7EBI8FqknCptXAPruVtDZrBCis4TE='),
            'password': vault.decrypt('encrypt$gAAAAABfruaXEDkaFksFMU8g97ydWyJF8p2KcSDJJBlzaOLDsLL6oCDYjG1kMPVESOzqjn8ThtSht1uZDuMCstA-sATmLS-EWQ=='),
            'interface': 'enp1s0.7',
            'dyndns': {
                'domain': 'franzi-home.kunbox.net',
                'url': 'https://ns-mephisto.kunbox.net/nic/update?hostname=franzi-home.kunbox.net&myip={ips}',
                'username': vault.decrypt('encrypt$gAAAAABfr8DLAJhmUIhdxLq83I8MnRRvkRgDZcO8Brvw1KpvplC3K8ZGj0jIIWD3Us33vIP6t0ybd_mgD8slpRUk78Kqd3BMoQ=='),
                'password': vault.decrypt('encrypt$gAAAAABfr8Cq5M1hweeJTQAl0dLhFntdlw-QnkIYUQpY-_ycODVWOpyeAwjwOgWLSdsdXIUvqcoiXPZPV-BE12p5C42NGnj9r7sKYpoGz8xfuGIk6haMa2g='),
            },
            'nftables-rules.d': {
                'inet filter forward iifname enp1s0.1139 oifname $INTERFACE accept',
            },
        },
        'unbound': {
            'dns64': False,
            'restrict-to': {
                '172.19.138.0/23',
                'fe80::/64',
            },
        },
        'users': {
            'f2k1de': {
                'delete': True,
            },
            'fkunsmann': {},
            'sophie': {},
        },
        'vnstat': {
            'interface': 'enp1s0.7',
        },
        'vm': {
            'cpu': 2,
            'ram': 4,
        },
        'wide-dhcp6c': {
            'source': 'ppp0',
            'targets': {
                'enp1s0.1138': '1',
                'enp1s0.1139': '2',
            },
        },
        'wireguard': {
            'snat_ip': '172.19.138.1',
        },
    },
}