# {{ ansible_managed }}

log to syslog level warn;
hide ip addresses yes;
status socket "/run/fastd-{{ site_code }}{{ item }}.sock";

interface "vpn-{{ site_code }}{{ item }}";

method "null";
method "salsa2012+umac";
method "xsalsa20-poly1305";

secure handshakes yes;

bind {{ fastd_bind }}:{{ fastd_port + item|int }};

include "secret.conf";

mtu {{ fastd_mtu }};

{% if fastd_peers_limit > -1 %}
peer limit {{ fastd_peers_limit }};
{% endif %}

on up "
	ifconfig $INTERFACE down
	ip link set address f2:00:90:00:{{ gateway_id }}:{{ 10 + item|int }} dev $INTERFACE
	ifconfig $INTERFACE up

	batctl -m {{ batman_interface }} if add $INTERFACE
";

on down "
	batctl -m {{ batman_interface }} if del $INTERFACE
";

{% if fastd_anonymous %}
on verify "/etc/fastd/{{ site_code }}/blacklist.sh /opt/{{ site_code }}/vpn-blacklist/blacklist.json";
{% endif %}

include peers from "peers";