# vyos002 — everything that must land before it is trusted on the network.
#
# Apply order matters only in that this is ONE commit: the eth2 address and the
# missing health-check are the two defects that caused the 2026-09-02 outage, and
# neither should survive a single reboot window.
#
#   ssh vyos@192.168.1.253   (or 10.0.1.253 — L2-direct, see RECOVERY-CARD)
#   configure; <paste>; commit; save

# 1. The ARP poisoner. eth2 is the 1G copper NIC on US24 port 16, native VLAN 2,
#    and it held 192.168.8.144/23 -- the same subnet as bond0.2. Two interfaces
#    answering for one subnet is what hijacked 192.168.8.1 and took the cluster
#    down: eth2's MAC answered while bond0.2's MAC routed.
#    Origin: eth2 was `address dhcp`, a kea reservation for the ROUTER'S OWN NIC
#    handed it .144, and a CLI commit froze it static.
delete interfaces ethernet eth2 address

# 2. The health-check. Without it this box can hold every floating IP while
#    having no WAN at all -- the outage itself. It goes on the SYNC GROUP; VyOS
#    rejects it per-group.
#    /config/vrrp-wan-health must be copied over FIRST (from migration/) and be
#    chmod +x, or the commit succeeds and the check silently never passes.
set high-availability vrrp sync-group MAIN health-check script '/config/vrrp-wan-health'
set high-availability vrrp sync-group MAIN health-check interval '5'
set high-availability vrrp sync-group MAIN health-check failure-count '3'

# 3. Management onto a tagged sub-interface, matching vyos001 (kea #1117).
#    Pair this with USW Aggregation port 3 (LAG 3+4) -> Native VLAN = None.
#    Until that switch change lands, leave these three commented out: vyos002
#    can run untagged on bond0 while vyos001 runs tagged -- one VLAN is one
#    broadcast domain, and the coexistence was proven in labsim.
# set interfaces bonding bond0 vif 1 address '192.168.1.253/24'
# set interfaces bonding bond0 vif 1 description 'management'
# delete interfaces bonding bond0 address
# set firewall group interface-group LAN interface 'bond0.1'
# delete firewall group interface-group LAN interface 'bond0'
# set high-availability vrrp group native interface 'bond0.1'