Step-by-step runbooks

git clone https://github.com/osisa/netsetup.git
cd netsetup
git checkout develop
git pull

#:project ../src/NETSetup/NETSetup.csproj
#:package osisa.UserManagement.Contracts

using System.Runtime.CompilerServices;
using System.Text.Json;

using Nuke.Common.IO;

using osisa.FileProviders.Physical;
using osisa.IO.Contracts;

using NETSetup.Config.Translators;
using NETSetup.Entities;
using NETSetup.Extensions;

using osisa.Enterprise.Contracts;
using osisa.Enterprise.Entities;
using osisa.Security.Contracts;
using osisa.SystemManagement.Contracts.Elements;
using osisa.SystemManagement.Contracts.Names;
using osisa.SystemManagement.Entities;
using osisa.UserManagement.Contracts;

var company = Company.CreateBuilder("laufentaler.org", "CH", "Roeschenz")
// Dyndns (homelab run): No-IP DDNS Key. Updating all.ddnskey.com pushes every hostname
// assigned to the key (laufentaler.ddns.net must be in the key's group). ddns-updater
// on the dns VM learns the WAN IP via curl echo and pushes it here.
// WARNING: live DDNS-Key creds - do NOT commit/push this file; revert to a placeholder
// before commit or rotate the key in No-IP afterward.
.AddDomainProvider(
"noip",
"35BWoCUF7nRS".ToSecretString(),
new[] { "all" },
username: "9pvx4ey",
secretKey: "password",
domain: "ddnskey.com")

.AddDevice("Liberator", DeviceTypes.Server) // Root Server
.WithSerialNumber("lib")
.WithDescription("Liberator")

.AddDevice("Power-1", DeviceTypes.Server)
.WithSerialNumber("power-1")
.WithDescription("Power Station")

// MikroTik hAP ax2 (WAN-facing AP/router for the Liberator stack). DeviceType
// AccessPoint -> NETSetupMikrotik. Description carries the admin password. Presence
// seeds the 'wifi' user + drives the Mikrotik converge. OPNsense itself is gated on
// the Description="Liberator" host (already present), not on this device.
.AddDevice("Mikrotik", DeviceTypes.AccessPoint)
.WithSerialNumber("mt")
.WithDescription("MikrotikAdmin4242$")

// OPNsense / Nextcloud / Mail / Dns / PMG VMs are now injected implicitly by
// LiberatorWithWinDCTranslator on the single Description="Liberator" host. Do NOT
// re-add explicit AddDevice blocks for them - the translator throws on conflict.
// Implicit VMIDs (10xx range, Proxmox-safe): OPNSense=1001, Dns=1002, Nextcloud=1020, Mail=1090, PMG=1091.

.AddDevice("DC", DeviceTypes.Server)
.WithSerialNumber("dc")
.WithDescription("Windows Server")

.AddDevice("DefaultClient1", DeviceTypes.Client)
.WithSerialNumber("client1")

.AddDevice("DefaultClient2", DeviceTypes.Client)
.WithSerialNumber("client2")


.AddTask(CommonTasks.Support)
.WithDevice("osisasupport", DeviceTypes.Software)

.AddTask(CommonTasks.Office)
.WithDevice("office365netsetup", DeviceTypes.Software)


.AddOrganizationalUnit("local")
.AddEmployee("A")
.HasTask(CommonTasks.Support)
.HasTask(CommonTasks.Office)
.UsesDevice((DeviceName)"DefaultClient1")
.UsesDevice((DeviceName)"DefaultClient2")

.AddEmployee("B")
.HasTask(CommonTasks.Support)
.UsesDevice((DeviceName)"DefaultClient1")
.UsesDevice((DeviceName)"DefaultClient2")

.Build();

// --- Translate to Config ---
// IP scheme = per-OU 10.X.0.0/24 auto (server .200-.240, client/DHCP .1-.199, gateway .254).
// Test bench leaves GatewayIP unset; VirtualHyperVTestBase fills it from the upstream NIC.
var translator = new LiberatorWithWinDCTranslator(company);
translator.Translate();
var config = translator.Config;

// Outbound relay via Brevo transactional SMTP (587, SASL). Chosen over M365 SMTP AUTH:
// M365 client submission only sends as the ONE authenticated mailbox, so on-prem a@/b@
// bounce with "554 5.2.252 SendAsDenied". Brevo sends as any address on the authenticated
// domain (no SendAs wall). See docs/dyndns-domain-setup.adoc -> "Mail Relay (Outbound
// Smarthost)" Method T. The SASL Login is the generated <id>@smtp-brevo.com value from
// Brevo's SMTP page, NOT the account email (account email -> 535 auth failed).
// !!! LIVE CREDS - DO NOT COMMIT. Rotate the Brevo SMTP key or swap to a placeholder
// before committing this file (same hazard as the live No-IP DDNS-Key creds below). !!!
config.AddMailRelay(
    "smtp-relay.brevo.com",
    "ac2c7d001@smtp-brevo.com",
    "xsmtpsib-d71a6a436ab4915d4b1ac3c1c2746a135f3ed3b42383f650f9e55ce4e4f42cea-d1YXzkaw8HYX64a8".ToSecretString());
 // Stub upstream gateway so ToProxmoxAutoInstall has a non-None GatewayIP.
 // VirtualHyperVTestBase overrides this with the real test-bench upstream.
 // Probably is this gateway override wrong
 //config.GatewayIP = IP.Parse("10.0.0.1");

config.ThrowIfNamesAreNotValid();

// --- Output ---
var json = JsonSerializer.Serialize(config, NETSetupConfig.JsonSerializerOptions);
Console.WriteLine(json);

AbsolutePath scriptDir = (AbsolutePath)GetScriptDir();
var fileOp = new PhysicalFileOperator(scriptDir, Microsoft.Extensions.Logging.Abstractions.NullLogger<PhysicalFileOperator>.Instance);
fileOp.WriteAllTextAsync("Customer.json", json, CancellationToken.None).Wait();
Console.Error.WriteLine($"Written to {scriptDir / "Customer.json"}");

static string GetScriptDir([CallerFilePath] string? path = null)
    => Path.GetDirectoryName(path)!;

dotnet run Customers\<Customer>.cs

Customers\_rebuild-all.cmd