# Orb Agent Configuration — Rendered by Ansible
# OpenBao address and orb-agent AppRole credentials resolved at deploy time.
# vault:// references resolved by the orb-agent at runtime.

orb:
  secrets_manager:
    active: vault
    sources:
      vault:
        address: "{{ openbao_addr }}"
        timeout: 30
        auth: "approle"
        auth_args:
          role_id: "{{ _orb_approle.role_id }}"
          secret_id: "{{ _orb_approle.secret_id }}"
          mount_path: "approle"
        schedule: "0 */1 * * *"

  config_manager:
    active: local

  backends:
    network_discovery:
    snmp_discovery:
    worker:
    common:
      diode:
        target: grpc://localhost:8081/diode
        client_id: "${vault://secret/services/netbox/orb_agent_client_id}"
        client_secret: "${vault://secret/services/netbox/orb_agent_client_secret}"
        agent_name: netbox-discovery-agent

  policies:
    network_discovery:
      subnet_scan:
        config:
          schedule: "0 */4 * * *"
          timeout: 15
          defaults:
            tags:
              - discovery-network
              - "site:uhstray-dc"
              - "discovery:auto"
            description: "Auto-discovered by network scan"
        scope:
          targets:
            - {{ discovery_target_subnet }}
          scan_types: [syn]
          # OS fingerprinting (nmap -O, requires privileged)
          os_detection: true
          # ICMP host discovery probes (run before port scan to find live hosts)
          # ping_scan is NOT set — it conflicts with scan_types
          icmp_echo: true
          icmp_timestamp: true
          icmp_netmask: true
          # Ports: agent-cloud services + common infrastructure
          ports:
            # Infrastructure
            - 22     # SSH
            - 53     # DNS
            - 80     # HTTP
            - 161    # SNMP
            - 443    # HTTPS
            # Agent-cloud services
            - 3000   # Semaphore, Grafana
            - 5432   # PostgreSQL
            - 5678   # n8n
            - 6379   # Redis
            - 8000   # NetBox
            - 8080   # Internal services (diode-auth, netbox internal)
            - 8081   # Diode gRPC ingress
            - 8181   # NocoDB
            - 8200   # OpenBao
            - 8443   # HTTPS alt
            - 9090   # Prometheus
            - 11434  # Ollama
          fast_mode: true
          timing: 3
          max_retries: 2
          use_target_masks: true

    snmp_discovery:
      snmp_scan:
        config:
          schedule: "0 */6 * * *"
          timeout: 600
          snmp_timeout: 10
          retries: 5
          lookup_extensions_dir: /opt/orb/snmp-extensions
          defaults:
            site: "Uhstray.io Datacenter"
            role: server
            tags:
              - discovery-snmp
              - "site:uhstray-dc"
              - "discovery:auto"
            device:
              description: "Auto-discovered via SNMP"
              comments: "Populated by orb-agent. sysObjectID determines device type."
            interface:
              description: "Auto-discovered interface"
              enabled: true
            ip_address:
              description: "Auto-discovered IP"
        scope:
          targets:
            - host: {{ discovery_target_subnet }}
          authentication:
            protocol_version: SNMPv2c
            community: "${vault://secret/services/netbox/snmp_community}"
          max_mib_depth: 10
          max_repetitions: 10

      # infrastructure_scan REMOVED — pfSense worker provides richer data
      # (serial, version, ARP, gateways, interface descriptions) at higher
      # frequency (15 min vs 6h). Keeping this would create duplicate Devices
      # because SNMP sysName ("pfsense") differs from REST API FQDN.
      # The subnet-wide snmp_scan above still discovers pfSense if SNMP is
      # enabled; the pfSense worker's Device name is aligned to match sysName
      # so Diode merges rather than duplicates.

    # ─── PFSENSE REST API SYNC (Worker) ────────────────────────────
    # Queries pfSense REST API for device, interfaces, IPs, ARP, gateways.
    # Runs every 15 minutes. Credentials from OpenBao vault.
    worker:
      pfsense_sync:
        config:
          package: pfsense_sync
          schedule: "*/15 * * * *"
          site_name: "{{ discovery_site_name | default('Uhstray.io Datacenter') }}"
          device_role: "{{ discovery_pfsense_device_role | default('gateway-router') }}"
          # Seed data — organizational hierarchy (values from site-config inventory)
          region_name: "{{ discovery_region | default('') }}"
          location_name: "{{ discovery_location_name | default('') }}"
          rack_name: "{{ discovery_pfsense_rack | default('') }}"
          tenant_name: "{{ discovery_tenant_name | default('') }}"
          site_latitude: "{{ discovery_site_latitude | default('') }}"
          site_longitude: "{{ discovery_site_longitude | default('') }}"
        scope:
          host: "${vault://secret/services/discovery/pfsense/host}"
          api_key: "${vault://secret/services/discovery/pfsense/api_key}"

      # ─── PROXMOX VE API DISCOVERY (Worker) ──────────────────────────
      # Discovers cluster nodes, QEMU VMs, and LXC containers.
      # Credentials from OpenBao vault. PVEAuditor role (read-only).
      proxmox_discovery:
        config:
          package: proxmox_discovery
          schedule: "*/15 * * * *"
          site_name: "{{ discovery_site_name | default('Uhstray.io Datacenter') }}"
          # Seed data — organizational hierarchy (values from site-config inventory)
          region_name: "{{ discovery_region | default('') }}"
          location_name: "{{ discovery_location_name | default('') }}"
          tenant_name: "{{ discovery_tenant_name | default('') }}"
          site_latitude: "{{ discovery_site_latitude | default('') }}"
          site_longitude: "{{ discovery_site_longitude | default('') }}"
          # Per-node rack assignments (physical nodes → rack names)
          rack_assignments:
{% for node, rack in (discovery_rack_assignments | default({})).items() | sort %}
            {{ node }}: "{{ rack }}"
{% endfor %}
        scope:
          url: "${vault://secret/services/discovery/proxmox_api/url}"
          token_id: "${vault://secret/services/discovery/proxmox_api/token_id}"
          api_token: "${vault://secret/services/discovery/proxmox_api/api_token}"
