heat_template_version: 2016-10-14

description: >
  OPNSense template.
  Creates an OPNSense appliance VM with 2 network interfaces, one connected to the internet (WAN) and 
  the second one connected to a newly created network (LAN).

parameters:
  lan_net_name:
    type: string
    label: LAN Network Name
    description: Specified name for the internal network.
    default: 'lan'

  wan_net_name:
    type: string
    label: Infomaniak public Network Name
    description: Network Name for the Internet.
    default: 'ext-net1'

  opnsense_image_name:
    type: string
    label: OPNSense Image Name
    description: Image name.
    default: 'OPNsense 22.1.2_2-amd64'

  opnsense_flavor_name:
    type: string
    label: OPNSense Flavor Name
    description: Amount of vcpus/ram/disk.
    default: 'a1-ram2-disk20-perf1'

  opnsense_server_name:
    type: string
    label: OPNSense Server Name
    description: Name of the OPNSense VM.
    default: 'OPNSense'

resources:
  lan_net:
    type: OS::Neutron::Net
    properties:
      name: {list_join: ['-', [{get_param: "OS::stack_name"}, { get_param: lan_net_name }]]}

  lan_subnet:
    type: OS::Neutron::Subnet
    properties:
      network_id: { get_resource: lan_net }
      name: {list_join: ['-', [{get_param: "OS::stack_name"}, { get_param: lan_net_name }, 'subnet']]}
      cidr: "190.168.95.0/24"
      gateway_ip: "190.168.95.1"
      dns_nameservers:
        - "84.16.67.69"
        - "84.16.67.70"
      enable_dhcp: true
      allocation_pools: [{"start": 190.168.95.100, "end": 190.168.95.200 }]

  opnsense_server:
    type: OS::Nova::Server
    properties:
      name: { get_param: opnsense_server_name }
      image: { get_param: opnsense_image_name }
      flavor: { get_param: opnsense_flavor_name }
      networks:
        - port: { get_resource: opnsense_server_lan_port }
        - port: { get_resource: opnsense_server_wan_port }

  opnsense_server_lan_port:
    type: OS::Neutron::Port
    properties:
      network_id: { get_resource: lan_net }
      port_security_enabled: False
      fixed_ips:
        - subnet_id: { get_resource: lan_subnet }
          ip_address: "190.168.95.1"

  opnsense_server_wan_port:
    type: OS::Neutron::Port
    properties:
      network: { get_param: wan_net_name }
      security_groups:
        - { get_resource: opnsense_wan_port_secgroup }

  opnsense_wan_port_secgroup:
    type: OS::Neutron::SecurityGroup
    properties:
      rules:
        - protocol: tcp
          remote_ip_prefix: 0.0.0.0/0
          port_range_min: 1
          port_range_max: 65535
        - protocol: esp
          remote_ip_prefix: 0.0.0.0/0
        - protocol: icmp
          remote_ip_prefix: 0.0.0.0/0
        - protocol: udp
          remote_ip_prefix: 0.0.0.0/0
          port_range_min: 1
          port_range_max: 65535

outputs:
  'Usage Notes':
    value: Configure the OPNSense via the VM console below and temporary disable the firewall to access the OPNsense web portal using pfctl -d.
    description: Tips
  'Default Credentials':
    value: 'root / clm2ppOPNSENSE!'
    description: Change this password once the appliance is deployed.
  'LAN IP':
    value: { get_attr: [ opnsense_server, networks, {list_join: ['-', [{get_param: "OS::stack_name"}, { get_param: lan_net_name }]]}, 0 ] }
    description: LAN IP address for the OPNSense appliance VM (vtnet0)
  'WAN IP':
    value: { get_attr: [ opnsense_server, networks, { get_param: wan_net_name }, 0 ] }
    description: LAN IP address for the OPNSense appliance VM (vtnet1)
  'VM Console':
    value: { get_attr: [ opnsense_server, console_urls, novnc ] }
    description: Console URL for the OPNSense appliance VM