version: "1.0"

metadata:
  name: lakeside-community-mesh
  operator: Lakeside Community Network Cooperative
  environment: production
  contact:
    email: noc@lakesidemesh.example
    phone: "+1-555-0100"
  timezone: America/Toronto

network:
  autonomous_system: 65042
  domain: mesh.lakeside.example
  address_pools:
    infrastructure_ipv4: 10.42.0.0/16
    subscriber_ipv4: 100.96.0.0/11
    management_ipv4: 10.255.0.0/24
    subscriber_ipv6: fd42:6d65:7368::/48
  dns:
    resolvers:
      - 1.1.1.1
      - 9.9.9.9
      - 2606:4700:4700::1111
      - 2620:fe::fe
    local_zone: mesh.lakeside.example

routing:
  mesh_protocol:
    name: babel
    interface_defaults:
      hello_interval_seconds: 4
      update_interval_seconds: 16
      link_quality: etx
  gateway_protocol:
    name: bgp
    local_as: 65042
    graceful_restart: true
    multipath: true
  default_route:
    advertise_from:
      - gateway-north
      - gateway-south
    preference:
      gateway-north: 100
      gateway-south: 90

sites:
  - id: gateway-north
    role: internet_gateway
    location:
      latitude: 43.6532
      longitude: -79.3832
      elevation_meters: 112
    management_address: 10.255.0.11
    uplinks:
      - provider: Example Transit North
        interface: eth0
        capacity_mbps: 2000
        public_ipv4: ${NORTH_GATEWAY_IPV4}
        bgp_peer: ${NORTH_BGP_PEER}
    radios:
      - interface: mesh0
        band: 5ghz
        channel_width_mhz: 40
        tx_power_dbm: 23

  - id: gateway-south
    role: internet_gateway
    location:
      latitude: 43.6426
      longitude: -79.3871
      elevation_meters: 98
    management_address: 10.255.0.12
    uplinks:
      - provider: Example Transit South
        interface: eth0
        capacity_mbps: 1000
        public_ipv4: ${SOUTH_GATEWAY_IPV4}
        bgp_peer: ${SOUTH_BGP_PEER}
    radios:
      - interface: mesh0
        band: 5ghz
        channel_width_mhz: 40
        tx_power_dbm: 23

  - id: library-rooftop
    role: relay
    management_address: 10.255.0.21
    location:
      latitude: 43.6488
      longitude: -79.3716
      elevation_meters: 105
    radios:
      - interface: mesh0
        band: 5ghz
        channel_width_mhz: 40
        tx_power_dbm: 20
      - interface: access0
        band: 2.4ghz
        channel_width_mhz: 20
        tx_power_dbm: 17

subscriber_access:
  authentication:
    method: radius
    server: radius.mesh.lakeside.example
    port: 1812
    secret: ${RADIUS_SHARED_SECRET}
  plans:
    - id: community-basic
      download_mbps: 50
      upload_mbps: 20
      monthly_transfer_gb: null
      priority: standard
    - id: community-plus
      download_mbps: 150
      upload_mbps: 50
      monthly_transfer_gb: null
      priority: high
    - id: public-access
      download_mbps: 10
      upload_mbps: 5
      session_limit_minutes: 240
      priority: low
  fair_queueing:
    algorithm: cake
    per_subscriber_isolation: true
    overhead_bytes: 22

services:
  dhcp:
    enabled: true
    lease_duration: 12h
    authoritative: true
  nat44:
    enabled: true
    mode: carrier_grade
    port_range: "1024-65535"
  ipv6:
    enabled: true
    router_advertisements: true
    prefix_delegation_size: 60
  captive_portal:
    enabled: true
    url: https://portal.lakesidemesh.example
    bypass_domains:
      - lakesidemesh.example
      - status.lakesidemesh.example

monitoring:
  metrics:
    enabled: true
    exporter_port: 9100
    scrape_interval: 30s
    retention_days: 90
  logs:
    destination: syslog.mesh.lakeside.example
    protocol: tls
    port: 6514
    retention_days: 30
  alerts:
    routes:
      - severity: critical
        receiver: noc-oncall
      - severity: warning
        receiver: operations
    thresholds:
      node_unreachable_seconds: 180
      packet_loss_percent: 15
      gateway_utilization_percent: 85
      backhaul_signal_dbm: -72

security:
  management:
    allowed_networks:
      - 10.255.0.0/24
      - fd42:6d65:7368:ffff::/64
    ssh:
      password_authentication: false
      permit_root_login: false
  firewall:
    default_input_policy: drop
    default_forward_policy: drop
    allow_established_connections: true
    subscriber_isolation: true
  updates:
    automatic_security_updates: true
    maintenance_window: "Sunday 03:00-05:00"
    rollout_strategy: canary
    canary_nodes:
      - library-rooftop

backup:
  enabled: true
  schedule: "0 2 * * *"
  destination: s3://lakeside-mesh-backups/network-config
  credentials_file: /run/secrets/backup_credentials
  retention:
    daily: 14
    weekly: 8
    monthly: 12