Site values¶

Decide these once, here, then substitute the <PLACEHOLDER> tokens as you work through the build. Values marked DECIDED come straight from the design; values marked CHOOSE are still open in the design docs and must be settled before cutover.

Autonomous systems¶

Token	Value	Status
`<OPN_AS>`	`65510`	DECIDED (§3)
`<CORE_AS>`	`65500` (both CCRs)	DECIDED (DESIGN §4.1)
`<UPSTREAM_AS>`	`204258` (WAN business borders)	DECIDED (`net-design/WAN.md`)

Public addressing¶

Token	Meaning	Status
`<PUBLIC_BLOCK>`	the routed block OPNsense announces + NATs from	CHOOSE — `/28` (DESIGN §5c) vs `/29` (`wan/WAN-EXISTING.md` calls it "PI's 40.8/29"). A /29 gives ~6 usable and squeezes 1:1 NAT. Settle before NAT.
`<PUBLIC_ROUTING_VIP>`	the CARP VIP FRR announcing/NAT hangs off	from `<PUBLIC_BLOCK>`
`<PAT_ADDR>`	single outbound PAT address (general egress)	from `<PUBLIC_BLOCK>`
`<PAYMENTS_ADDR>`	fixed, whitelisted payments egress — never pooled (§5c)	from `<PUBLIC_BLOCK>`

WAN transit /31s (per node, per border — 4 total)¶

A /31 has no room for a VIP; the BGP source is each node's real /31 address (§5a).

Token	Link	Status
`<FW01_BDR1_31>` / `<BDR1_FW01>`	FW-01 ↔ bdr-1	CHOOSE (from the WAN business /22)
`<FW01_BDR2_31>` / `<BDR2_FW01>`	FW-01 ↔ bdr-2	CHOOSE
`<FW02_BDR1_31>` / `<BDR1_FW02>`	FW-02 ↔ bdr-1	CHOOSE
`<FW02_BDR2_31>` / `<BDR2_FW02>`	FW-02 ↔ bdr-2	CHOOSE

Core /31s (per node, per CCR — 4 total)¶

Token	Link	Status
`<FW01_CR1_31>` / `<CR1_FW01>`	FW-01 ↔ CR-COLO-01	CHOOSE (from `10.254.x` p2p space)
`<FW01_CR2_31>` / `<CR2_FW01>`	FW-01 ↔ CR-COLO-02	CHOOSE
`<FW02_CR1_31>` / `<CR1_FW02>`	FW-02 ↔ CR-COLO-01	CHOOSE
`<FW02_CR2_31>` / `<CR2_FW02>`	FW-02 ↔ CR-COLO-02	CHOOSE

Server-room VLANs (routed — gateway on OPNsense)¶

DECIDED from DESIGN §7.1. Ceph VLANs 920/921/922 are L2-only and must NOT appear on OPNsense — they have no gateway anywhere.

VLAN	Zone	Subnet	Gateway (CARP VIP)	VHID
910	Backup	`10.128.10.0/24`	`10.128.10.1`	10
930	Tier-1 (AD, POS, payments)	`10.128.32.0/22`	`10.128.32.1`	30
931	Tier-2 (general, UniFi, RADIUS, monitoring)	`10.128.36.0/22`	`10.128.36.1`	31
932	DMZ (internet-exposed)	`10.128.40.0/24`	`10.128.40.1`	32
940	Hypervisor mgmt / live-migration	`10.128.44.0/24`	`10.128.44.1`	40

OOB¶

Token	Meaning	Status
`<OOB_NET>`	OOB subnet	CHOOSE — DESIGN is self-inconsistent: §7.1 `10.128.9.0/24`, §7.3 text `10.1.9.0/24`, §7.3 Zabbix leg implies `10.201.201.0/24`. Reconcile, then set.
`<OOB_FW01>` / `<OOB_FW02>`	per-node OOB address (no gateway, no VIP)	from `<OOB_NET>`

Monitoring / IDS targets (VLAN 934)¶

Token	Meaning
`<ZABBIX_IP>`	Zabbix server/proxy on `10.128.34.x`
`<WAZUH_IP>`	Wazuh manager on `10.128.34.x` (Suricata EVE ingest)
`<SYSLOG_IP>`	syslog collector on `10.128.34.x`

CARP¶

Token	Value
`<CARP_ADVSKEW_PRIMARY>`	`0` on FW-01
`<CARP_ADVSKEW_BACKUP>`	`100` on FW-02
`<CARP_PASSWORD>`	shared CARP password (same on both nodes, per VHID group)

All CARP VIPs share the same advskew per node

So master status moves as one and FRR (which tracks a single "routing" VIP) follows the whole pair's election (§3). Set advskew per node, not per VIP.