professional-service-best-practices/professional-service
20
1
Fork 0
Code Issues Pull requests 3 Projects Releases Packages Wiki Activity Actions

refactor(opnsense) #57

Merged
mauritz.uphoff merged 5 commits from fix/opnsense into main 2026-08-04 07:33:12 +00:00
Conversation 4 Commits 5 Files changed 15 +630 -75
sven.schmidt commented 2026-08-04 06:31:50 +00:00
Owner
Copy link

Closes #51

Reworks the OPNsense hub-and-spoke example:

  • Removes now-unnecessary static routes from the hub network config; routing is handled at the spoke level instead
  • Switches all subnets from /28 to /24 (WAN 10.28.0.0/24, LAN 10.28.1.0/24, MGMT 10.28.2.0/24, spokes 10.28.10.0/24 and 10.28.20.0/24)
  • Standardizes firewall interface IPs to x.x.x.100 and names the interfaces (WAN_interface, LAN_interface, MGMT_interface)
  • Adds initial-setup, MGMT web UI access, limitations (HA), and Ansible-standardization-evaluation docs
  • Adds per-project READMEs for 001-hub-project, 002-spoke-project, 003-spoke-project
Closes #51 Reworks the OPNsense hub-and-spoke example: - Removes now-unnecessary static routes from the hub network config; routing is handled at the spoke level instead - Switches all subnets from /28 to /24 (WAN 10.28.0.0/24, LAN 10.28.1.0/24, MGMT 10.28.2.0/24, spokes 10.28.10.0/24 and 10.28.20.0/24) - Standardizes firewall interface IPs to x.x.x.100 and names the interfaces (WAN_interface, LAN_interface, MGMT_interface) - Adds initial-setup, MGMT web UI access, limitations (HA), and Ansible-standardization-evaluation docs - Adds per-project READMEs for 001-hub-project, 002-spoke-project, 003-spoke-project 
feat: update Terraform backend configuration for local override
refactor: remove unused routing table resources from network configuration
chore: delete obsolete opnsense.qcow2 file
refactor(opnsense): switch hub-and-spoke subnets to /24 and add named firewall interfaces
All checks were successful
AI PR Review / AI PR Review (pull_request) Successful in 1m2s
Details
Default CI / Check for Open TODOs (pull_request) Successful in 33s
Details
Default CI / Pre-Commit Hooks (pull_request) Successful in 2m14s
Details
bd16313750
sven.schmidt commented 2026-08-04 06:32:10 +00:00
Author
Owner
Copy link

@marc.adrian @mauritz.uphoff

Please review :)

@marc.adrian @mauritz.uphoff Please review :)
forgejo-actions commented 2026-08-04 06:33:09 +00:00
Copy link

πŸ€– AI PR Review

Reviewing changes up to bd163137

πŸ“ Spelling & Grammar

βœ… No spelling or grammar issues found.

πŸ—οΈ Infrastructure Changes
  • ⚠️ Deleted two stackit_routing_table_route resources (fw_network and fw_network_wan) β€” this removes default routes from firewall routing tables, potentially breaking connectivity.
# Safer alternative: retain routes but update next_hop if needed
resource "stackit_routing_table_route" "fw_network" {
  network_area_id  = stackit_network_area.sna.network_area_id
  organization_id  = var.stackit_organization_id
  routing_table_id = stackit_routing_table.rt_firewall_lan.routing_table_id
  destination = {
    type  = "cidrv4"
    value = "0.0.0.0/0"
  }
  next_hop = {
    type  = "ipv4"
    value = stackit_network_interface.nic_lan.ipv4
  }
}

resource "stackit_routing_table_route" "fw_network_wan" {
  network_area_id  = stackit_network_area.sna.network_area_id
  organization_id  = var.stackit_organization_id
  routing_table_id = stackit_routing_table.rt_firewall_wan.routing_table_id
  destination = {
    type  = "cidrv4"
    value = "0.0.0.0/0"
  }
  next_hop = {
    type = "internet"
  }
}
  • Modified stackit_network resources (wan_network, lan_network, mgmt_network) to use /24 prefixes instead of /28 β€” expands IP ranges significantly.
  • Added name attributes to stackit_network_interface resources (nic_wan, nic_lan, nic_mgmt) for better identification.
  • Updated IP assignments for network interfaces to match new /24 subnets.
  • Updated spoke_subnet and hub_firewall_lan_ip variables in spoke projects to align with new hub network layout.
πŸ”’ Security Review

βœ… No security issues found.

πŸ“ Example Consistency

βœ… Example follows repository conventions.

πŸ“š Example README

βœ… Example READMEs are complete.

πŸ“š Module Variable & Output Coverage

No relevant changes to review.

πŸ’¬ Commit Messages
  • "feat: update Terraform backend configuration for local override" β†’ Suggest: "feat(terraform): update backend config to support local override for development environments"
  • "refactor: remove unused routing table resources from network configuration" β†’ Suggest: "refactor(network): remove unused routing table resources to simplify configuration"
  • "chore: delete obsolete opnsense.qcow2 file" β†’ Suggest: "chore(opnsense): remove obsolete opnsense.qcow2 image file no longer used in deployment"

βœ… Commit messages are descriptive.

Generated automatically β€” treat as a hint, not a gate.

## πŸ€– AI PR Review > Reviewing changes up to [`bd163137`](https://professional-service.git.onstackit.cloud/professional-service-best-practices/professional-service/commit/bd163137504d16c8208a8f11de8238797772e40c) <details> <summary>πŸ“ Spelling & Grammar</summary> βœ… No spelling or grammar issues found. </details> <details> <summary>πŸ—οΈ Infrastructure Changes</summary> - ⚠️ Deleted two `stackit_routing_table_route` resources (`fw_network` and `fw_network_wan`) β€” this removes default routes from firewall routing tables, potentially breaking connectivity. ```hcl # Safer alternative: retain routes but update next_hop if needed resource "stackit_routing_table_route" "fw_network" { network_area_id = stackit_network_area.sna.network_area_id organization_id = var.stackit_organization_id routing_table_id = stackit_routing_table.rt_firewall_lan.routing_table_id destination = { type = "cidrv4" value = "0.0.0.0/0" } next_hop = { type = "ipv4" value = stackit_network_interface.nic_lan.ipv4 } } resource "stackit_routing_table_route" "fw_network_wan" { network_area_id = stackit_network_area.sna.network_area_id organization_id = var.stackit_organization_id routing_table_id = stackit_routing_table.rt_firewall_wan.routing_table_id destination = { type = "cidrv4" value = "0.0.0.0/0" } next_hop = { type = "internet" } } ``` - Modified `stackit_network` resources (`wan_network`, `lan_network`, `mgmt_network`) to use /24 prefixes instead of /28 β€” expands IP ranges significantly. - Added `name` attributes to `stackit_network_interface` resources (`nic_wan`, `nic_lan`, `nic_mgmt`) for better identification. - Updated IP assignments for network interfaces to match new /24 subnets. - Updated `spoke_subnet` and `hub_firewall_lan_ip` variables in spoke projects to align with new hub network layout. </details> <details> <summary>πŸ”’ Security Review</summary> βœ… No security issues found. </details> <details> <summary>πŸ“ Example Consistency</summary> βœ… Example follows repository conventions. </details> <details> <summary>πŸ“š Example README</summary> βœ… Example READMEs are complete. </details> <details> <summary>πŸ“š Module Variable & Output Coverage</summary> _No relevant changes to review._ </details> <details> <summary>πŸ’¬ Commit Messages</summary> - "feat: update Terraform backend configuration for local override" β†’ Suggest: "feat(terraform): update backend config to support local override for development environments" - "refactor: remove unused routing table resources from network configuration" β†’ Suggest: "refactor(network): remove unused routing table resources to simplify configuration" - "chore: delete obsolete opnsense.qcow2 file" β†’ Suggest: "chore(opnsense): remove obsolete opnsense.qcow2 image file no longer used in deployment" βœ… Commit messages are descriptive. </details> --- _Generated automatically β€” treat as a hint, not a gate._
feat(opnsense): update backend configuration and enhance documentation for automation options
All checks were successful
Default CI / Check for Open TODOs (pull_request) Successful in 26s
Details
AI PR Review / AI PR Review (pull_request) Successful in 55s
Details
Default CI / Pre-Commit Hooks (pull_request) Successful in 1m58s
Details
9dbf0c0fe2
forgejo-actions commented 2026-08-04 07:25:29 +00:00
Copy link

πŸ€– AI PR Review

Reviewing changes up to 9dbf0c0f

πŸ“ Spelling & Grammar

βœ… No spelling or grammar issues found.

πŸ—οΈ Infrastructure Changes
  • ⚠️ Deleted stackit_routing_table_route resources for fw_network and fw_network_wan (destructive change)
  • Modified stackit_network resources (wan_network, lan_network, mgmt_network) to use larger CIDR ranges (/24 instead of /28)
  • Updated stackit_network_interface IPs and added name attributes for nic_wan, nic_lan, nic_mgmt
  • Updated spoke_subnet and hub_firewall_lan_ip variables in spoke projects to reflect new IP scheme
# Safer alternative: Replace deleted routing table routes with new ones instead of deletion
resource "stackit_routing_table_route" "fw_network" {
  network_area_id  = stackit_network_area.sna.network_area_id
  organization_id  = var.stackit_organization_id
  routing_table_id = stackit_routing_table.rt_firewall_lan.routing_table_id
  destination = {
    type  = "cidrv4"
    value = "0.0.0.0/0"
  }
  next_hop = {
    type  = "ipv4"
    value = stackit_network_interface.nic_lan.ipv4
  }
}

resource "stackit_routing_table_route" "fw_network_wan" {
  network_area_id  = stackit_network_area.sna.network_area_id
  organization_id  = var.stackit_organization_id
  routing_table_id = stackit_routing_table.rt_firewall_wan.routing_table_id
  destination = {
    type  = "cidrv4"
    value = "0.0.0.0/0"
  }
  next_hop = {
    type = "internet"
  }
}
πŸ”’ Security Review

βœ… No security issues found.

πŸ“ Example Consistency
  • Branding error: "stackit" should be "STACKIT" in .terraform.lock.hcl provider block.
provider "registry.terraform.io/STACKITcloud/STACKIT" {
  version     = "0.107.1"
  constraints = ">= 0.80.0"
  hashes = [
    "h1:o7St6va/RfXxf2aA4rASwq/Obue9X7kPCIodrxwiL+Y=",
    "zh:0dde99e7b343fa01f8eefc378171fb8621bedb20f59157d6cc8e3d46c738105f",
    "zh:151695cb1f05240ee1b7fa3bcaa09536a0f840b2dd86933f9eef04315f194fab",
    "zh:226bab6400118ac595677bc65b78b056b3be48c0d247c00eca68b07f390997e3",
    "zh:24145057a4c9ecfef9ba57b113f0d0d436fa69ca2cac48961f4fd09a0c9e4a9d",
    "zh:342502623d5638a2710d69badae374ad6d7312f0a75e4b8bed337a3c119fd30d",
    "zh:6811673cc06c7f94491c0fba9c95e2fd653febffe15b226e007cbd1b77cadf8d",
    "zh:713c25d37260fc9d1cc77f1fdecc3aa7a37f2a1df01d6e599c4913a780f8535d",
    "zh:84a5bdde4764924000c6735594d03c8a76ef649eb3332f81f26f0294e2821e23",
    "zh:cd0285b528f6ec95676b6e8bfaeb03f4dd41483f28637e12873c7708d1d6d47c",
    "zh:d25e56fa9e2c99aff3b433c8ccd944648a0dd64db23b81847d53a37e93ae5013",
    "zh:d75ddb9580615004c389a4b93a23eb57885eb152d95a00bf9e928d323f052fee",
    "zh:d8ee2656576f98c6c9ca01a6d3c508cbe094d81b10ab6b6bbbc93e89e7c17d4f",
    "zh:e30da9b81108c23b579e3f76b24e32d203f169dc79b0045549890b4b1c2ca623",
    "zh:ec353130d0cf77d1ac8f1494cfd8d045a942ba5c0f31a5bac720cd456cb43caa",
  ]
}
  • Missing Apache 2.0 license header in 030-network.tf.
# Copyright 2024 STACKIT. All rights reserved.
#
# Licensed under the Apache License, Version 2.0

</details>

<details>
<summary>πŸ“š Example README</summary>

βœ… Example READMEs are complete.

</details>

<details>
<summary>πŸ“š Module Variable & Output Coverage</summary>

_No relevant changes to review._

</details>

<details>
<summary>πŸ’¬ Commit Messages</summary>

- "feat: update Terraform backend configuration for local override" β†’ Suggest: "feat(terraform): update backend configuration to support local override with environment-specific variables"
- "refactor: remove unused routing table resources from network configuration" β†’ Suggest: "refactor(network): remove obsolete routing table resources to simplify network topology and reduce drift risk"
- "chore: delete obsolete opnsense.qcow2 file" β†’ Suggest: "chore(opnsense): remove obsolete opnsense.qcow2 disk image to clean up legacy artifacts"

</details>


---
_Generated automatically β€” treat as a hint, not a gate._
## πŸ€– AI PR Review > Reviewing changes up to [`9dbf0c0f`](https://professional-service.git.onstackit.cloud/professional-service-best-practices/professional-service/commit/9dbf0c0fe21cc9da3f0ed7f49bf9e7f479955ee2) <details> <summary>πŸ“ Spelling & Grammar</summary> βœ… No spelling or grammar issues found. </details> <details> <summary>πŸ—οΈ Infrastructure Changes</summary> - ⚠️ Deleted `stackit_routing_table_route` resources for `fw_network` and `fw_network_wan` (destructive change) - Modified `stackit_network` resources (`wan_network`, `lan_network`, `mgmt_network`) to use larger CIDR ranges (/24 instead of /28) - Updated `stackit_network_interface` IPs and added `name` attributes for `nic_wan`, `nic_lan`, `nic_mgmt` - Updated `spoke_subnet` and `hub_firewall_lan_ip` variables in spoke projects to reflect new IP scheme ```hcl # Safer alternative: Replace deleted routing table routes with new ones instead of deletion resource "stackit_routing_table_route" "fw_network" { network_area_id = stackit_network_area.sna.network_area_id organization_id = var.stackit_organization_id routing_table_id = stackit_routing_table.rt_firewall_lan.routing_table_id destination = { type = "cidrv4" value = "0.0.0.0/0" } next_hop = { type = "ipv4" value = stackit_network_interface.nic_lan.ipv4 } } resource "stackit_routing_table_route" "fw_network_wan" { network_area_id = stackit_network_area.sna.network_area_id organization_id = var.stackit_organization_id routing_table_id = stackit_routing_table.rt_firewall_wan.routing_table_id destination = { type = "cidrv4" value = "0.0.0.0/0" } next_hop = { type = "internet" } } ``` </details> <details> <summary>πŸ”’ Security Review</summary> βœ… No security issues found. </details> <details> <summary>πŸ“ Example Consistency</summary> - Branding error: "stackit" should be "STACKIT" in `.terraform.lock.hcl` provider block. ```terraform provider "registry.terraform.io/STACKITcloud/STACKIT" { version = "0.107.1" constraints = ">= 0.80.0" hashes = [ "h1:o7St6va/RfXxf2aA4rASwq/Obue9X7kPCIodrxwiL+Y=", "zh:0dde99e7b343fa01f8eefc378171fb8621bedb20f59157d6cc8e3d46c738105f", "zh:151695cb1f05240ee1b7fa3bcaa09536a0f840b2dd86933f9eef04315f194fab", "zh:226bab6400118ac595677bc65b78b056b3be48c0d247c00eca68b07f390997e3", "zh:24145057a4c9ecfef9ba57b113f0d0d436fa69ca2cac48961f4fd09a0c9e4a9d", "zh:342502623d5638a2710d69badae374ad6d7312f0a75e4b8bed337a3c119fd30d", "zh:6811673cc06c7f94491c0fba9c95e2fd653febffe15b226e007cbd1b77cadf8d", "zh:713c25d37260fc9d1cc77f1fdecc3aa7a37f2a1df01d6e599c4913a780f8535d", "zh:84a5bdde4764924000c6735594d03c8a76ef649eb3332f81f26f0294e2821e23", "zh:cd0285b528f6ec95676b6e8bfaeb03f4dd41483f28637e12873c7708d1d6d47c", "zh:d25e56fa9e2c99aff3b433c8ccd944648a0dd64db23b81847d53a37e93ae5013", "zh:d75ddb9580615004c389a4b93a23eb57885eb152d95a00bf9e928d323f052fee", "zh:d8ee2656576f98c6c9ca01a6d3c508cbe094d81b10ab6b6bbbc93e89e7c17d4f", "zh:e30da9b81108c23b579e3f76b24e32d203f169dc79b0045549890b4b1c2ca623", "zh:ec353130d0cf77d1ac8f1494cfd8d045a942ba5c0f31a5bac720cd456cb43caa", ] } ``` - Missing Apache 2.0 license header in `030-network.tf`. ```terraform # Copyright 2024 STACKIT. All rights reserved. # # Licensed under the Apache License, Version 2.0 </details> <details> <summary>πŸ“š Example README</summary> βœ… Example READMEs are complete. </details> <details> <summary>πŸ“š Module Variable & Output Coverage</summary> _No relevant changes to review._ </details> <details> <summary>πŸ’¬ Commit Messages</summary> - "feat: update Terraform backend configuration for local override" β†’ Suggest: "feat(terraform): update backend configuration to support local override with environment-specific variables" - "refactor: remove unused routing table resources from network configuration" β†’ Suggest: "refactor(network): remove obsolete routing table resources to simplify network topology and reduce drift risk" - "chore: delete obsolete opnsense.qcow2 file" β†’ Suggest: "chore(opnsense): remove obsolete opnsense.qcow2 disk image to clean up legacy artifacts" </details> --- _Generated automatically β€” treat as a hint, not a gate._
mauritz.uphoff commented 2026-08-04 07:33:07 +00:00
Owner
Copy link

Perfect! Merged!

Perfect! Merged!
mauritz.uphoff deleted branch fix/opnsense 2026-08-04 07:33:13 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
sven.schmidt
marc.adrian
mauritz.uphoff
3 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
professional-service-best-practices/professional-service!57
No description provided.