$schema: https://json-schema.org/draft/2020-12/schema
title: CarlOS netconfig
description: Network configuration description for CarlOS routers
type: object
definitions:
  ipAddress:
    type: string
    pattern: ^([0-9]{1,3}\.){3}[0-9]{1,3}$
  ip6Address:
    type: string
    pattern: ^([0-9a-f]{0,4}:){2,7}[0-9a-f]{0,4}$
  ip46Address:
    oneOf:
    - $ref: "#/definitions/ipAddress"
    - $ref: "#/definitions/ip6Address"
  ipAddressCidr:
    type: string
    pattern: ^([0-9]{1,3}\.){3}[0-9]{1,3}/[0-9]{1,2}$
  ip6AddressCidr:
    type: string
    pattern: ^([0-9a-f]{0,4}:){2,7}[0-9a-f]{0,4}/[0-9]{1,3}$
  ip46AddressCidr:
    oneOf:
    - $ref: "#/definitions/ipAddressCidr"
    - $ref: "#/definitions/ip6AddressCidr"
  macAddress:
    type: string
    minLength: 12
    maxLength: 12
    pattern: ^[0-9a-f]{12}$
  interfaceName:
    type: string
    pattern: ^((vrf|mbm|lan|sfp|wfi|br|vxl|xfrm|veth|vmtap)[0-9]+(\.[0-9]+)?|((vmtap|lan)[0-9]+(\.(rej|acc[0-9]*))))$
  ioPinState:
    type: object
    description: IO pin to configure
    properties:
      state:
        description: State to set the IO pin to
        type: string
        enum:
        - low
        - high
    required:
    - state
    additionalProperties: false
  ioModulePin:
    type: object
    description: I/O module and pin references
    oneOf:
    - properties:
        module:
          description: I/O module
          enum:
          - g403-slot3
        pin:
          description: I/O pin
          enum: [
            11, 12, 13, 14,
            21, 22, 23, 24,
            31, 32, 33, 34,
            41, 42, 43, 44
          ]
      required:
      - module
      - pin
    - properties:
        module:
          description: I/O module
          enum:
          - isa-rest
        pin:
          description: I/O pin
          enum:
          - wifi
      required:
      - module
      - pin
  portNumber:
    type: integer
    minimum: 1
    maximum: 65535
  portRange:
    type: array
    minItems: 2
    maxItems: 2
    items:
      $ref: "#/definitions/portNumber"
  uuid:
    type: string
    pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$
  storageLocation:
    type: string
    pattern: ^(((USB[1-4]?|SSD[12]?|BUNDLE):[a-zA-Z0-9\-\._~]+)|INTERNAL)$
  writeableStorageLocation:
    type: string
    pattern: ^(SSD[12]?:[0-9]+|INTERNAL)$
  networkTestClient:
    type: object
    properties:
      scheme:
        description: Network traffic scheme name
        type: string
        pattern: ^(burst|call|fetch|flood|icmp|liveness|ping|stream)$
      connect:
        description: Destination IP address to test against
        $ref: "#/definitions/ip46Address"
      bind:
        description: Local client address to bind to
        $ref: "#/definitions/ip46Address"
      options:
        description: Scheme specific options
        type: object
        properties:
          interval:
            description: Interval to run test in, in ms
            type: integer
          up-rate:
            description: Client upload rate, in kbit/s
            type: integer
          down-rate:
            description: Client download rate, in kbit/s
            type: integer
          pkt-size:
            description: Size of UDP packet payload, in bytes
            type: integer
          count:
            description: Number of actions to perform each interval
            type: integer
          buf-size:
            description: Buffer size for stream caching, kB
            type: integer
          file-size:
            description: File size for fetches, kB
            type: integer
          ifname:
            description: Interface name where to send packets from
            $ref: "#/definitions/interfaceName"
        additionalProperties: false
    required:
    - scheme
    - connect
    additionalProperties: false
  resolver-dns:
    description: List of upstream DNS resolvers to forward to
    type: array
    minItems: 1
    items:
      type: object
      properties:
        server:
          description: DNS server IP address to forward to
          $ref: "#/definitions/ip46Address"
        port:
          description: DNS server port
          default: 53
          $ref: "#/definitions/portNumber"
        source:
          description: Local source address to use
          $ref: "#/definitions/ip46Address"
        ifname:
          description: Interface or VRF to forward over
          $ref: "#/definitions/interfaceName"
      required:
      - server
      additionalProperties: false
  static-dns:
    type: object
    patternProperties:
      ^([\*][\.]|(([a-zA-Z0-9_]|[a-zA-Z0-9_][a-zA-Z0-9\-_]*[a-zA-Z0-9_]))\.)*([A-Za-z0-9_]|[A-Za-z0-9_][A-Za-z0-9\-_]*[A-Za-z0-9_])$:
        description: Domain name to handle with static entry
        type: object
        properties:
          A:
            description: List of IPv4 address A records to serve
            type: array
            items:
              $ref: "#/definitions/ipAddress"
          AAAA:
            description: List of IPv6 address AAAA records to serve
            type: array
            items:
              $ref: "#/definitions/ip6Address"
        additionalProperties: false
    additionalProperties: false
  netconfItems:
    type: object
    properties:
      addr:
        description: Static IP address configuration
        type: object
        patternProperties:
          ^((lan|sfp|wfi|br|vxl|lo|vrf|ivr|veth|vmtap|xfrm)[0-9]*(\.[0-9]+)?|(lan[0-9]+(\.(rej|acc[0-9]*))))$:
            type: array
            items:
              description: Address with network prefix in CIDR notation to add
              $ref: "#/definitions/ip46AddressCidr"
        additionalProperties: false
      can:
        description: CAN Bus interface configuration
        type: object
        patternProperties:
          ^(can)[0-9]*$:
            description: CAN Bus interface name
            type: object
            properties:
              bitrate:
                description: Bitrate to operate interface at
                type: integer
              mode:
                description: CAN Bus socket mode to forward CAN frames, optional
                enum:
                - raw
                - j1939
                - fms
              options:
                description: CAN Bus socket mode options, optional
                type: object
                properties:
                  for-dead-reckoning:
                    description: |
                      Whether to forward FMS wheel based speed into GNSS service
                      for dead reckoning.
                    default: false
                    type: boolean
                additionalProperties: false
              forward:
                description: Forward CAN frames to other interfaces
                type: array
                items:
                  type: string
                  pattern: ^(can|vxcan|vmcan)[0-9]+$
            required:
            - bitrate
            additionalProperties: false
        additionalProperties: false
      vrf:
        description: VRF interface configuration
        type: object
        patternProperties:
          ^(vrf)[0-9]*$:
            description: VRF interface name to create
            type: object
            properties:
              table:
                description: Routing table to use
                type: integer
                oneOf:
                - minimum: 10
                  maximum: 219
                - minimum: 221
                  maximum: 252
                - minimum: 256
                  maximum: 499
              slaves:
                description: List of interfaces to enslave on VRF interface
                type: array
                items:
                  $ref: "#/definitions/interfaceName"
              interconnect:
                description: List of interconnect interface pairs
                type: object
                patternProperties:
                  ^ivr[0-9]{1,2}$:
                    description: Inter-VRF routing interface pair
                    type: string
                    pattern: ^ivr[0-9]{1,2}$
                additionalProperties: false
            required:
            - table
            - slaves
            additionalProperties: false
        additionalProperties: false
      route:
        description: List of static routes to configure
        type: array
        items:
          type: object
          properties:
            dst:
              description: CIDR notation network of route destination
              $ref: "#/definitions/ip46AddressCidr"
            via:
              description: Nexthop gateway to route over
              $ref: "#/definitions/ip46Address"
            ifname:
              description: Output interface to route over
              $ref: "#/definitions/interfaceName"
            metric:
              description: Route priority
              type: integer
              minimum: 0
              maximum: 65535
            table:
              description: Table id to install route into
              type: integer
          oneOf:
          - required:
            - dst
            - via
          - required:
            - dst
            - ifname
          additionalProperties: false
      dhcp:
        description: DHCP configuration
        type: object
        properties:
          client:
            description: DHCP client configuration
            type: object
            patternProperties:
              ^(lan|sfp|wfi|br|vxl|veth|vmtap)[0-9]+(\.[0-9]+)?$:
                description: Interface to run DHCP client on
                type: object
                properties:
                  metric:
                    description: Metric to install a default route with
                    type: integer
                    minimum: 0
                    maximum: 65535
                  retransmit:
                    type: integer
                    minimum: 100
                    maximum: 5000
                  use-dns:
                    description: Apply received DNS entries for this interface
                    type: boolean
                  class-id:
                    description: DHCP Vendor-Class attribute to send in requests
                    type: string
                  hostname:
                    description: |
                      DHCP Option 12, DHCP Host Name to send in requests,
                      default: System hostname
                    type: string
                    pattern: ^[a-zA-Z0-9\-\.:]{1,64}$
                  user-class:
                    description: List of DHCP User-Class attributes to send
                    type: array
                    items:
                      type: string
                additionalProperties: false
            additionalProperties: false
          server:
            description: DHCP server configuration
            type: object
            patternProperties:
              ^((lan|sfp|wfi|br|vxl|veth|vmtap)[0-9]+(\.[0-9]+)?||(lan[0-9]+(\.(rej|acc[0-9]*))))$:
                description: Interface to run DHCP server on
                type: object
                properties:
                  range:
                    description: |
                      DHCP lease range, array with two elements:
                      - First IP address in DHCP lease range
                      - Last IP address in DHCP lease range, inclusive
                    type: array
                    items:
                      $ref: "#/definitions/ipAddress"
                    minItems: 2
                    maxItems: 2
                  prefix:
                    description: Network prefix to assign
                    type: integer
                    minimum: 1
                    maximum: 32
                  duration:
                    description: DHCP lease duration, in seconds
                    type: integer
                    minimum: 1
                  router:
                    description: Default gateway to assign
                    $ref: "#/definitions/ipAddress"
                  nameserver:
                    description: List of nameserver IP addresses
                    type: array
                    items:
                      $ref: "#/definitions/ipAddress"
                    maxItems: 2
                  ntpserver:
                    description: List of NTP servers to advertise
                    type: array
                    items:
                      $ref: "#/definitions/ipAddress"
                    maxItems: 4
                  vendor:
                    description: RFC 3925 vendor specific options
                    type: object
                    patternProperties:
                      ^.*$:
                        description: |
                          Per vendor options for a given Vendor Class ID
                          or IANA PEN
                        type: object
                        patternProperties:
                          ^([1-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5]|0x[0-9A-Fa-f]{1,2})$:
                            description: |
                              Value for given vendor specific option code
                            type: string
                        additionalProperties: false
                    additionalProperties: false
                  static:
                    description: List of static leases
                    type: array
                    items:
                      type: object
                      properties:
                        hostname:
                          description: Client hostname to match
                          type: string
                          pattern: ^[a-zA-Z0-9\-\.:]{1,64}$
                        circuit-id:
                          description: |
                            Relay agent Circuit ID to match
                          type: string
                        remote-id:
                          description: |
                            Relay agent Remote ID to match
                          type: string
                        addr:
                          description: Static IP address to assign
                          $ref: "#/definitions/ipAddress"
                      additionalProperties: false
                      anyOf:
                      - required:
                        - hostname
                        - addr
                      - required:
                        - circuit-id
                        - addr
                      - required:
                        - remote-id
                        - addr
                required:
                - range
                - prefix
                additionalProperties: false
            additionalProperties: false
          relay:
            description: DHCP relay configuration
            type: object
            patternProperties:
              ^((lan|sfp|wfi|br|vxl|veth|vmtap)[0-9]+(\.[0-9]+)?|(lan[0-9]+(\.(rej|acc[0-9]*))))$:
                description: Interface to operate DHCP relay on
                type: object
                properties:
                  servers:
                    description: List of servers to forward DHCP requests to
                    type: array
                    items:
                      $ref: "#/definitions/ipAddress"
                  interfaces:
                    description: List of interfaces to re-broadcast to
                    type: array
                    items:
                      $ref: "#/definitions/interfaceName"
                  circuit-id:
                    description: Relay agent Circuit-id to insert
                    type: string
                  remote-id:
                    description: Relay agent Remote-id to insert
                    type: string
                additionalProperties: false
            additionalProperties: false
        additionalProperties: false
      dhcpv6:
        description: DHCP6 configuration
        type: object
        properties:
          relay:
            description: DHCP6 relay configuration
            type: object
            patternProperties:
              ^((lan|sfp|wfi|br|vxl|veth|vmtap)[0-9]+(\.[0-9]+)?|(lan[0-9]+(\.(rej|acc[0-9]*))))$:
                description: Interface to operate DHCP6 relay on
                type: object
                properties:
                  servers:
                    description: List of servers to forward DHCP6 requests to
                    type: array
                    items:
                      $ref: "#/definitions/ip6Address"
                additionalProperties: false
            additionalProperties: false
        additionalProperties: false
      dns:
        description: Domain Name System configuration
        type: object
        properties:
          static:
            description: Static local DNS entries
            $ref: "#/definitions/static-dns"
          forwarder:
            description: DNS forwarding server
            oneOf:
            - type: object
              deprecated: true
              patternProperties:
                ^((lan|sfp|wfi|br|vxl|veth|vmtap)[0-9]+(\.[0-9]+)?|(lan[0-9]+(\.(rej|acc[0-9]*))))$:
                  description: Legacy forwarder configuration format
                  type: object
                  properties:
                    resolver:
                      $ref: "#/definitions/resolver-dns"
                    static:
                      $ref: "#/definitions/static-dns"
                  required:
                  - resolver
                  additionalProperties: false
              additionalProperties: false
            - type: array
              items:
                type: object
                properties:
                  ifname:
                    description: Interface to listen for DNS requests
                    $ref: "#/definitions/interfaceName"
                  resolver:
                    $ref: "#/definitions/resolver-dns"
                  static:
                    description: Static DNS records to serve in forwarder
                    $ref: "#/definitions/static-dns"
                required:
                - resolver
                additionalProperties: false
        additionalProperties: false
      vlan:
        description: VLAN configuration
        type: object
        patternProperties:
          ^(lan|sfp|br)[0-9]+(\.[0-9]+)$:
            description: VLAN interface to add
            type: object
            properties:
              vlanid:
                description: VLAN id to use
                type: integer
                minimum: 1
                maximum: 4094
              parent:
                description: Parent interface to add VLAN to
                type: string
                pattern: ^(lan|sfp|br)[0-9]+$
            required:
            - vlanid
            - parent
            additionalProperties: false
        additionalProperties: false
      vxlan:
        description: VXLAN configuration
        type: object
        patternProperties:
          ^(vxl)[0-9]+$:
            description: VXLAN interface to add
            type: object
            properties:
              vxlanid:
                description: VXLAN id to use
                type: integer
                minimum: 0
                maximum: 16777215
              group:
                description: Multicast address to use for VXLAN group
                $ref: "#/definitions/ipAddress"
              parent:
                description: Parent interface to add VXLAN to
                $ref: "#/definitions/interfaceName"
            required:
            - vxlanid
            - group
            - parent
            additionalProperties: false
        additionalProperties: false
      bridge:
        description: Bridge configuration
        type: object
        patternProperties:
          ^(br)[0-9]+$:
            description: Name of bridge interface to create
            type: object
            properties:
              slaves:
                description: List of interfaces to enslave on bridge
                type: array
                items:
                  type: string
                  pattern: ^((lan|br|sfp|wfi|vxl|veth|vmtap)[0-9]+(\.[0-9]+)?|((vmtap|lan)[0-9]+(\.(rej|acc[0-9]*))))$
              isolate:
                description: Whether to isolate bridge ports on Layer 2
                default: false
                type: boolean
            required:
            - slaves
            additionalProperties: false
        additionalProperties: false
      wifi:
        description: WiFi configuration
        type: object
        properties:
          client:
            description: WiFi client configuration
            type: object
            patternProperties:
              ^(wfi)[0-9](\.[0-9]+)?$:
                description: WiFi interface to configure in station mode
                type: object
                properties:
                  parent:
                    description: Parent interface to create STA interface on
                    type: string
                    pattern: ^(wfi)[0-9]$
                  networks:
                    description: Network candidates to configure on interface
                    type: array
                    items:
                      type: object
                      properties:
                        ssid:
                          description: SSID of network to join
                          type: string
                          minLength: 1
                          maxLength: 31
                        hidden:
                          description: Use explicit scan to connect to the SSID
                          default: false
                          type: boolean
                        psk:
                          description: WPA2 PSK to authenticate with
                          type: string
                          minLength: 8
                        username:
                          description: |
                            WPA2-enterprise username to authenticate with
                          type: string
                        password:
                          description: |
                            WPA2-enterprise password to authenticate with
                          type: string
                        ca:
                          description: |
                            Subject Distinguished Name of AAA TLS root CA
                          type: string
                        aaa:
                          description: |
                            Acceptable AAA TLS certificate subjectAltNames
                          type: array
                          items:
                            type: string
                        roaming:
                          description: |
                            Signal threshold to switch to aggressive scans
                          type: integer
                          maximum: -10
                          minimum: -110
                      required:
                      - ssid
                      additionalProperties: false
                additionalProperties: false
            additionalProperties: false
          ap:
            description: WiFi access point configuration
            type: object
            patternProperties:
              ^(wfi)[0-9](\.[0-9]+)?$:
                description: Interface to configure Access Point on
                type: object
                properties:
                  parent:
                    description: Parent interface to create AP interface on
                    type: string
                    pattern: ^(wfi)[0-9]$
                  mac:
                    description: Hex encoded MAC address for interface
                    $ref: "#/definitions/macAddress"
                  ssid:
                    description: SSID to run on AP
                    type: string
                    minLength: 1
                    maxLength: 31
                  hidden:
                    description: Hide SSID, requiring explicit client scans
                    default: false
                    type: boolean
                  channel:
                    description: WiFi channel and implicit channel width
                    type: integer
                    enum: [
                      0, 1, 3, 5, 6, 9, 11, 12, 13,
                      33, 36, 38, 40, 44, 46, 48, 52, 54, 56, 60, 62, 64,
                      100, 102, 104, 108, 110, 112, 116, 118, 120,
                      124, 126, 128, 132, 134, 136, 140, 142, 144,
                      149, 151, 153, 157, 159, 161, 165
                    ]
                  power:
                    description: TX power limit, in dBm
                    type: integer
                    minimum: 1
                    maximum: 20
                  psk:
                    description: WPA2 preshared key for protected APs
                    type: string
                    minLength: 8
                  radius:
                    description: RADIUS Authentication information
                    type: object
                    properties:
                      nasid:
                        description: NAS-ID name to use in RADIUS requests
                        type: string
                      client-addr:
                        description: IP address used for RADIUS client
                        $ref: "#/definitions/ipAddress"
                      client-dev:
                        description: Interface name to bind RADIUS socket to
                        type: string
                      servers:
                        description: List of RADIUS authentication servers
                        type: array
                        items:
                          type: object
                          properties:
                            server:
                              description: IP address of RADIUS server
                              $ref: "#/definitions/ipAddress"
                            secret:
                              description: |
                                Secret for RADIUS server authentication
                              type: string
                            type:
                              description: |
                                Type of service the RADIUS server should be used
                                for. Possible values:
                                - `auth`: server is only used for authentication
                                - `acct`: server is only user for accounting
                                - `both`: server is used for both authentication
                                          and accounting
                                Note: When configuring an accounting RADIUS
                                server, an authentication server has also to be
                                provided for the Access Point to work.
                              type: string
                              enum:
                              - auth
                              - acct
                              - both
                              default: auth
                          required:
                          - server
                          - secret
                          additionalProperties: false
                        minItems: 1
                        maxItems: 4
                        if:
                          contains:
                            properties:
                              type:
                                const: acct
                            required:
                            - type
                        then:
                          contains:
                            properties:
                              type:
                                enum:
                                - auth
                                - both
                            required:
                            - type
                    required:
                    - nasid
                    - servers
                    additionalProperties: false
                  cc:
                    description: Regulatory domain ISO/IEC 3166-1 country code
                    type: string
                    minLength: 2
                    maxLength: 2
                  rcoi:
                    description: |
                      Hex encoded Roaming Consortium OIs to advertise by the AP.
                      The length is between 3 and 15 octets.
                    type: array
                    items:
                      type: string
                      pattern: ^[0-9a-fA-F]{6,30}
                  isolate:
                    description: Isolate clients from each other on Layer 2
                    default: false
                    type: boolean
                required:
                - ssid
                - channel
                - cc
                additionalProperties: false
            additionalProperties: false
          mesh:
            description: WiFi mesh network configuration
            type: object
            patternProperties:
              ^(wfi)[0-9](\.[0-9]+)?$:
                description: Interface to configure mesh network on
                type: object
                properties:
                  parent:
                    description: Parent interface to create MESH interface on
                    type: string
                    pattern: ^(wfi)[0-9]$
                  mac:
                    description: Hex encoded MAC address for interface
                    $ref: "#/definitions/macAddress"
                  ssid:
                    description: SSID of mesh network
                    type: string
                    minLength: 1
                    maxLength: 31
                  channel:
                    description: WiFi channel and implicit channel width
                    type: integer
                    enum: [
                      1, 5, 6, 9, 11, 13,
                      36, 40, 44, 48, 52, 56, 60, 64,
                      100, 104, 108, 112, 116, 120, 124, 128, 132,
                      136, 140, 144, 149, 153, 157, 161, 165
                    ]
                  power:
                    description: TX power limit, in dBm
                    type: integer
                    minimum: 1
                    maximum: 20
                  psk:
                    description: SAE preshared key for protected mesh networks
                    type: string
                    minLength: 8
                  cc:
                    description: Regulatory domain ISO/IEC 3166-1 country code
                    type: string
                    minLength: 2
                    maxLength: 2
                required:
                - ssid
                - channel
                - cc
                additionalProperties: false
          mon:
            description: WiFi monitor configuration
            type: object
            patternProperties:
              ^(wfi)[0-9](\.[0-9]+)?$:
                description: Interface to configure monitoring on
                type: object
                properties:
                  parent:
                    description: Parent interface of monitoring interface
                    type: string
                    pattern: ^(wfi)[0-9]$
                  filter:
                    description: |
                      Packet filter to sniff packets with:
                      - `probe-req`: Filter for WiFi probe requests
                    type: string
                    enum:
                    - probe-req
                required:
                - filter
                additionalProperties: false
        additionalProperties: false
      modem:
        description: Modem and roaming configuration
        type: object
        properties:
          roaming:
            description: Roaming policy configuration
            type: object
            properties:
              default:
                description: Default roaming policy, enable to allow roaming
                default: false
                type: boolean
            patternProperties:
              ^(allow|deny)$:
                description: |
                  List of IMSI prefixes or modem interface names to
                  allow/deny roaming for
                type: object
                patternProperties:
                  ^(mbm[0-9]|[0-9]+)$:
                    description: |
                      IMSI prefix or modem interface to match with
                      country codes to allow/deny roaming for
                    type: array
                    items:
                      type: integer
                      minimum: 1
                      maximum: 999
                additionalProperties: false
          slots:
            description: SIM slot configuration
            type: object
            patternProperties:
              ^(mbm)[0-9]$:
                description: |
                  Modem interface with SIM slot candidates for modem
                type: array
                items:
                  type: integer
                  minimum: 1
                  maximum: 30
            additionalProperties: false
          apn:
            description: Custom APN configuration
            type: object
            patternProperties:
              ^(mbm[0-9]|[0-9]{5})$:
                description: |
                  APN settings for IMSI prefix or modem interface name
                type: object
                properties:
                  apn:
                    description: Custom APN name
                    type: string
                  username:
                    description: Custom APN username
                    type: string
                  password:
                    description: Custom APN password
                    type: string
                  auth:
                    description: Explicit authentication type
                    enum:
                    - pap
                    - chap
                  mtu:
                    description: Custom Maximum Transmission Unit (MTU) for APN
                    type: integer
                    default: 1428
                    minimum: 576
                    maximum: 1500
                  routes:
                    description: |
                      Route destinations in CIDR format to install for this APN
                    type: array
                    items:
                      $ref: "#/definitions/ipAddressCidr"
                required:
                - apn
                additionalProperties: false
            additionalProperties: false
          net:
            description: Modem network configuration
            type: object
            patternProperties:
              ^mbm[0-9]+$:
                description: Modem interface for network configuration
                type: object
                properties:
                  use-dns:
                    description: Learn and use DNS servers from operator
                    default: false
                    type: boolean
            additionalProperties: false
          pin:
            description: SIM PIN configuration
            type: object
            properties:
              iccid:
                description: PINs defined for specific SIM cards by ICCIDs
                type: object
                patternProperties:
                  ^[0-9]{18,22}$:
                    description: ICCID to PIN mapping
                    type: string
                    pattern: ^[0-9]{4,8}$
                additionalProperties: false
              slot:
                description: PINs defined for SIM cards by SIM slot
                type: object
                patternProperties:
                  ^[1-4]{1}$:
                    description: SIM slot to PIN mapping
                    type: string
                    pattern: ^[0-9]{4,8}$
                additionalProperties: false
            additionalProperties: false
        additionalProperties: false
      vpn:
        description: VPN tunnel configuration with multipath support
        type: object
        properties:
          tunnels:
            description: Multipath tunnel configuration
            type: object
            patternProperties:
              ^.*$:
                description: Name of tunnel configuration
                type: object
                patternProperties:
                  ^(local|remote)-ts:
                    description: Local/Remote subnets to send over tunnel
                    type: array
                    maxItems: 16
                    uniqueItems: true
                    items:
                      $ref: "#/definitions/ip46AddressCidr"
                properties:
                  gateway:
                    description: VPN gateway hostname to connect to
                    type: string
                  probe:
                    description: Optional latency probe server IP address
                    oneOf:
                    - $ref: "#/definitions/ip46Address"
                    - const: ""
                  ca:
                    description: |
                      Identity of CA that must have issued gateway certificate
                    type: string
                  identity:
                    description: Local IKE identity to use
                    type: string
                  xfrmi:
                    description: Name of XFRM interface to create for tunnel
                    type: string
                    pattern: ^xfrm[0-9]+$
                  uplinks:
                    description: Uplinks to use for tunnel
                    type: object
                    patternProperties:
                      ^(lan|sfp|wfi|mbm|br|vxl|veth|vmtap)[0-9]+(\.[0-9]+)?$:
                        description: Interface to use as uplink
                        type: object
                        properties:
                          quality:
                            description: Uplink quality base
                            type: integer
                            minimum: 1
                            maximum: 65534
                          prio:
                            description: Uplink priority group
                            type: integer
                            minimum: 1
                            maximum: 65534
                        additionalProperties: false
                    minProperties: 1
                    additionalProperties: false
                required:
                - gateway
                - identity
                - xfrmi
                - uplinks
                additionalProperties: false
            additionalProperties: false
          latencies:
            description: Target latency configuration
            type: object
            patternProperties:
              ^(lan|sfp|wfi|mbm|br|vxl|veth|vmtap)[0-9]+(\.[0-9]+)?$:
                description: Per interface configuration
                type: object
                properties:
                  target:
                    description: Target latency for interface, in ms
                    type: integer
                    minimum: 1
                additionalProperties: false
          qos:
            description: QoS traffic class configuration
            type: object
            patternProperties:
              ^.*$:
                description: Arbitrary name of QoS class
                type: object
                properties:
                  selectors:
                    description: List of traffic patterns to match
                    type: array
                    items:
                      type: object
                      patternProperties:
                        ^(src|dst)$:
                          $ref: "#/definitions/ipAddressCidr"
                        ^(tcp|udp)$:
                          description: Layer 4 protocol match
                          type: object
                          properties:
                            dst-port:
                              description: Destination port to match
                              $ref: "#/definitions/portNumber"
                          required:
                          - dst-port
                          additionalProperties: false
                      additionalProperties: false
                  absolute:
                    description: Absolute QoS bandwidth reservation, kbit/s
                    type: integer
                  relative:
                    type: integer
                    description: Relative QoS bandwidth reservation, in per-cent
                required:
                - selectors
                additionalProperties: false
            additionalProperties: false
          bypass:
            description: IPsec bypass ruleset
            type: object
            properties:
              subnet:
                description: Static subnet based tunnel bypass rules
                type: object
                patternProperties:
                  ^.*$:
                    description: Bypass rule with full-meshed subnet list
                    type: array
                    maxItems: 16
                    uniqueItems: true
                    items:
                      $ref: "#/definitions/ip46AddressCidr"
                additionalProperties: false
              interface:
                description: Interface based bypass
                type: object
                patternProperties:
                  ^.*$:
                    description: Bypass rule with full-meshed interface list
                    type: array
                    items:
                      $ref: "#/definitions/interfaceName"
                additionalProperties: false
            additionalProperties: false
          clusters:
            description: Cluster gateway configuration
            type: object
            maxProperties: 32
            patternProperties:
              ^.*$:
                description: Name of cluster, shared by nodes
                type: object
                properties:
                  ifname:
                    description: Interface to serve clients on
                    $ref: "#/definitions/interfaceName"
                  sync-ifname:
                    description: Cluster sync interface, defaults to `ifname`
                    $ref: "#/definitions/interfaceName"
                  clusterip:
                    description: Shared virtual cluster IP to use
                    $ref: "#/definitions/ipAddress"
                  secret:
                    description: Shared secret for cluster node authentication
                    type: string
                  mac-count:
                    description: Number of cluster MACs to use, defaults to 8
                    type: integer
                    enum: [
                      2, 4, 8, 16, 32, 64,
                    ]
                  rebalance:
                    description: Rebalance for flow-granular load-balancing
                    default: false
                    type: boolean
                  tunnels:
                    description: List of tunnels to sync in this cluster
                    type: array
                    items:
                      type: string
                required:
                - ifname
                - secret
                - tunnels
                additionalProperties: false
            additionalProperties: false
        additionalProperties: false
      firewall:
        description: Abstract firewall configuration
        type: object
        properties:
          policy:
            description: |
              Global firewall policies
            type: object
            properties:
              icmp-forward:
                description: |
                  ICMP forwarding policy
                  - `allow`: Allow all ICMP messages, both within VRFs and
                             when crossing VRFs over _ivr_ devices.
                  - `drop`: Drop any ICMP echo request in the forwarding but
                            allows all other ICMP messages.
                  If the option is omitted, any ICMP messages within the same
                  VRF are allowed and it drops unrelated ICMP traffic when
                  crossing VRFs through _ivr_ devices.
                type: string
                enum:
                - allow
                - drop
            additionalProperties: false
          forward:
            description: Traffic allowed in forwarding
            type: array
            items:
              type: object
              properties:
                iif:
                  description: Input interface to match
                  type: string
                oif:
                  description: Output interface to match
                  type: string
              patternProperties:
                ^(src|dst)$:
                  description: |
                    CIDR subnet source/destination address to match
                  $ref: "#/definitions/ip46AddressCidr"
                ^(tcp|udp)$:
                  description: Layer 4 protocol match for TCP/UDP
                  type: object
                  patternProperties:
                    ^(src|dst)$:
                      description: Source/Destination port to match
                      $ref: "#/definitions/portNumber"
                    ^(src|dst)-range$:
                      description: Range of source/destination ports to match
                      $ref: "#/definitions/portRange"
                  additionalProperties: false
                ^(icmp|icmp6)$:
                  description: |
                    Layer 4 protocol match for ICMP/ICMPv6
                  type: object
                  patternProperties:
                    ^(type|code)$:
                      description: ICMP message type/code to match
                      $ref: "#/definitions/portNumber"
                  additionalProperties: false
              additionalProperties: false
          dnat:
            description: Destination NAT ruleset
            type: array
            items:
              type: object
              properties:
                iif:
                  description: Input interface to match
                  type: string
              patternProperties:
                ^(src|dst)$:
                  description: CIDR subnet source/destination address to match
                  $ref: "#/definitions/ipAddressCidr"
                ^to$:
                  description: CIDR subnet to map destination to
                  $ref: "#/definitions/ipAddressCidr"
                ^(tcp|udp)$:
                  type: object
                  description: Layer 4 protocol match for TCP/UDP
                  patternProperties:
                    ^(src|dst)$:
                      description: Source/Destination port to match
                      $ref: "#/definitions/portNumber"
                    ^(src|dst)-range$:
                      description: Range of source/destination ports to match
                      $ref: "#/definitions/portRange"
                    ^to$:
                      description: Port to translate destination port to
                      $ref: "#/definitions/portNumber"
                    ^to-range$:
                      description: Destination port range to translate to
                      $ref: "#/definitions/portRange"
                  additionalProperties: false
              required:
              - to
              additionalProperties: false
          snat:
            description: Source NAT ruleset
            type: array
            items:
              type: object
              properties:
                oif:
                  description: Output interface to match, optional
                  type: string
              patternProperties:
                ^(src|dst)$:
                  description: CIDR subnet source/destination address to match
                  $ref: "#/definitions/ipAddressCidr"
                ^to$:
                  description: CIDR subnet to map source address to
                  $ref: "#/definitions/ipAddressCidr"
                ^(tcp|udp)$:
                  type: object
                  description: Layer 4 protocol match for TCP/UDP
                  patternProperties:
                    ^(src|dst)$:
                      description: Source/Destination port to match
                      $ref: "#/definitions/portNumber"
                    ^to$:
                      description: Port to translate source port to
                      $ref: "#/definitions/portNumber"
                    ^(src|dst)-range$:
                      description: Range of source/destination ports to match
                      $ref: "#/definitions/portRange"
                    ^to-range$:
                      description: Source port range to translate to
                      $ref: "#/definitions/portRange"
                  additionalProperties: false
              required:
              - to
              additionalProperties: false
          input:
            description: Local input traffic to accept
            type: array
            items:
              type: object
              properties:
                iif:
                  description: Input interface to match, optional
                  type: string
              patternProperties:
                ^(tcp|udp)$:
                  description: Layer 4 protocol match for TCP/UDP
                  type: object
                  properties:
                    dst:
                      description: Port to open
                      $ref: "#/definitions/portNumber"
                  additionalProperties: false
                  required:
                  - dst
              additionalProperties: false
          masq:
            description: Masquerade rules
            type: array
            items:
              type: object
              properties:
                oif:
                  description: Output interface to masquerade IP on
                  type: string
              required:
              - oif
              additionalProperties: false
          netmap:
            type: array
            description: NAT rules for whole subnets
            items:
              type: object
              properties:
                iif:
                  description: Legacy alias for ifname
                  deprecated: true
                  type: string
                ifname:
                  description: Interface name to match
                  $ref: "#/definitions/interfaceName"
                from:
                  description: CIDR subnet of address to map from
                  $ref: "#/definitions/ipAddressCidr"
                to:
                  description: CIDR subnet of address to map to
                  $ref: "#/definitions/ipAddressCidr"
                match:
                  description: CIDR subnet of address to match against
                  $ref: "#/definitions/ipAddressCidr"
              required:
              - from
              - to
              additionalProperties: false
        additionalProperties: false
      voltage:
        description: Ignition voltage loss detection
        type: object
        properties:
          settings:
            description: Voltage loss detection settings
            type: object
            properties:
              follow-up:
                description: Follow-up-time in s before shutting down
                type: integer
                minimum: 0
            additionalProperties: false
        additionalProperties: false
      api:
        description: HTTP/REST API configurations
        type: array
        items:
          type: object
          properties:
            port:
              description: TCP HTTP port to listen on
              $ref: "#/definitions/portNumber"
            ifname:
              description: Interface name to bind HTTP socket to
              $ref: "#/definitions/interfaceName"
            handler:
              description: Handlers to configure on this instance
              type: object
              properties:
                apc:
                  description: Automated Passenger Counting handler
                  type: object
                  properties: {}
                  additionalProperties: false
                can:
                  description: CAN data handler
                  type: object
                  properties: {}
                  additionalProperties: false
                cpu:
                  description: System CPU usage handler
                  type: object
                  properties: {}
                  additionalProperties: false
                gnss:
                  description: GNSS handler
                  type: object
                  properties:
                    inject-wheel-speed:
                      description: |
                        Whether to allow injecting external wheel speed for
                        dead reckoning.
                      type: boolean
                      default: false
                  additionalProperties: false
                led:
                  description: Status LED handler
                  type: object
                  properties: {}
                  additionalProperties: false
                link:
                  description: Network link statistics handler
                  type: object
                  properties: {}
                  additionalProperties: false
                memory:
                  description: System memory usage handler
                  type: object
                  properties: {}
                  additionalProperties: false
                modem:
                  description: Modem information handler
                  type: object
                  properties: {}
                  additionalProperties: false
                time:
                  description: Time handler
                  type: object
                  properties: {}
                  additionalProperties: false
                imu:
                  description: Inertial Measurement Unit handler
                  type: object
                  properties: {}
                  additionalProperties: false
                io:
                  description: Digital I/O pins handler
                  type: object
                  properties:
                    get:
                      description: |
                        List of pins that are read-only. Each pin is provided
                        with an alias name that will be exposed.
                      type: object
                      patternProperties:
                        ^[a-zA-Z0-9\-\.:_]+$:
                          description: Alias name for the specific pin
                          $ref: "#/definitions/ioModulePin"
                          unevaluatedProperties: false
                    set:
                      description: |
                        List of pins that are read/write. Each pin is provided
                        with an alias name that will be exposed.
                      type: object
                      patternProperties:
                        ^[a-zA-Z0-9\-\._]+$:
                          description: Alias name for the specific pin
                          $ref: "#/definitions/ioModulePin"
                          properties:
                            default:
                              description: |
                                Default state of the pin. The pin will be set
                                to this state upon I/O API initialization.
                              type: string
                              enum:
                              - low
                              - high
                          unevaluatedProperties: false
                    additionalProperties: false
                sms:
                  description: Modem Short Message Service handler
                  type: object
                  properties: {}
                  additionalProperties: false
                storage:
                  description: Storage information handler
                  type: object
                  properties: {}
                  additionalProperties: false
                system:
                  description: System status information handler
                  type: object
                  properties: {}
                  additionalProperties: false
                vpn:
                  description: VPN tunnel state and information handler
                  type: object
                  properties: {}
                  additionalProperties: false
              additionalProperties: false
          required:
          - port
          - handler
          additionalProperties: false
      http:
        description: HTTP storage configurations
        type: array
        items:
          type: object
          properties:
            location:
              description: Content/Templates storage location identifier
              $ref: "#/definitions/storageLocation"
            type:
              type: string
              deprecated: true
              pattern: ^(removable|bundle)$
            ifname:
              description: interface name to bind HTTP socket to
              $ref: "#/definitions/interfaceName"
            port:
              description: TCP HTTP port to listen on
              $ref: "#/definitions/portNumber"
          required:
          - location
          - port
          additionalProperties: false
      ntp:
        description: NTP service configurations
        type: array
        items:
          type: object
          properties:
            ifname:
              description: Interface to bind NTP server socket to
              $ref: "#/definitions/interfaceName"
          required:
          - ifname
          additionalProperties: false
      container:
        description: Container configuration
        type: object
        patternProperties:
          ^[a-zA-Z0-9\-\._~:]+$:
            description: Container instance with a unique name
            type: object
            properties:
              location:
                description: Container image storage location identifier
                $ref: "#/definitions/storageLocation"
              image:
                description: Image name under storage location
                type: string
                pattern: ^[a-zA-Z0-9\-\._~:]+$
              size:
                description: Size limit for zram overlay disk, in bytes
                type: integer
              mem:
                description: Memory limit for zram overlay, in bytes
                type: integer
              veth:
                description: veth interface pair names to wire into container
                type: object
                maxProperties: 16
                patternProperties:
                  ^veth[0-9]+$:
                    description: |
                      Interface names, where key is host side and value is
                      container side
                    type: string
                    pattern: ^[a-z0-9\.]+$
                additionalProperties: false
              vxcan:
                description: VXCAN interface pair names to wire into container
                type: object
                maxProperties: 4
                patternProperties:
                  ^vxcan[0-9]+$:
                    description: |
                      Interface names, where key is host side and value is
                      container side
                    type: string
                    pattern: ^[a-z0-9\.]+$
                additionalProperties: false
              physif:
                description: Physical interfaces to move into container
                type: array
                maxItems: 16
                uniqueItems: true
                items:
                  type: string
                  pattern: ^(lan|sfp|can)[0-9]+$
              env:
                description: Environment variables to pass to container
                type: array
                maxItems: 32
                items:
                  type: string
                  pattern: ^[a-zA-Z0-9\.\-_~:]+=.*$
              nodes:
                description: Device nodes the container has access to
                type: array
                maxItems: 8
                uniqueItems: true
                items:
                  type: string
                  pattern: ^[a-zA-Z0-9\-\._~:]+$
              shares:
                description: Additional shared mounts to provide to container
                type: array
                maxItems: 8
                uniqueItems: true
                items:
                  type: object
                  properties:
                    location:
                      description: Shared folder storage location identifier
                      $ref: "#/definitions/storageLocation"
                    directory:
                      description: Host directory under location to bind mount
                      type: string
                      pattern: ^[a-zA-Z0-9\-\._~:]+$
                    mountpoint:
                      description: Container side mount point path
                      type: string
                      pattern: ^/[a-zA-Z0-9\-\._~:/]+$
                  required:
                  - location
                  - directory
                  - mountpoint
                  additionalProperties: false
            oneOf:
            - required:
              - location
              - image
              - size
            - required:
              - location
              - image
              - mem
            additionalProperties: false
        additionalProperties: false
      vm:
        description: Virtual machine configuration
        type: object
        patternProperties:
          ^[a-zA-Z0-9\-\._~:]+$:
            description: Virtual machine with unique name
            type: object
            properties:
              mem:
                description: Guest VM memory size, in MB
                type: integer
                minimum: 64
              cores:
                description: Guest VM CPU core count
                default: 1
                type: integer
                minimum: 1
              base:
                description: Read-only base image to start VM from
                type: object
                properties:
                  location:
                    description: VM base image storage location identifier
                    $ref: "#/definitions/storageLocation"
                  image:
                    description: |
                      RAW format base image filename under storage location
                    type: string
                    pattern: ^[a-zA-Z0-9\-\._~:]+$
                required:
                - location
                - image
                additionalProperties: false
              overlays:
                description: CoW overlay images to stack on top of base image
                type: array
                items:
                  type: object
                  properties:
                    location:
                      description: Storage location identifier for overlay
                      $ref: "#/definitions/writeableStorageLocation"
                    image:
                      description: Filename of qcow2 overlay image
                      type: string
                      pattern: ^[a-zA-Z0-9\-\._~:]+$
                    purge:
                      description: |
                        Optional overlay purging mode:
                        - `on-stop`: Purge overlay on VM stop or restart
                        - `on-change`: Purge overlay on underlay change
                      default: on-change
                      enum:
                      - on-stop
                      - on-change
                required:
                - location
                - image
                additionalProperties: false
              disks:
                description: Plain disk drives to attach to VM
                type: array
                items:
                  type: object
                  properties:
                    location:
                      description: Storage location identifier for disk
                      type: string
                      $ref: "#/definitions/writeableStorageLocation"
                    image:
                      type: string
                      pattern: ^[a-zA-Z0-9\-\._~:]+$
                      description: Filename of disk image
                    size:
                      type: integer
                      description: Disk size, in MB
                  required:
                  - location
                  - image
                  - size
                  additionalProperties: false
              network:
                description: List of network interfaces to create
                type: array
                items:
                  type: object
                  properties:
                    ifname:
                      description: Host side interface name to create
                      type: string
                      pattern: ^vmtap[0-9]+$
                    mac:
                      description: Hex-encoded MAC address, optional
                      $ref: "#/definitions/macAddress"
                  required:
                  - ifname
                  additionalProperties: false
              can:
                description: List of VCAN interfaces to create
                type: array
                items:
                  type: object
                  properties:
                    ifname:
                      description: Host side VCAN interface name to create
                      type: string
                      pattern: ^vmcan[0-9]+$
                  required:
                  - ifname
                  additionalProperties: false
              vnc:
                description: VNC server listen ports
                type: array
                items:
                  type: object
                  properties:
                    port:
                      description: Port to create VNC service listener on
                      $ref: "#/definitions/portNumber"
                    ifname:
                      description: Interface to bind VNC service to
                      $ref: "#/definitions/interfaceName"
                  additionalProperties: false
                  required:
                  - port
              dmi:
                description: SMBIOS/DMI variables to set
                type: object
                patternProperties:
                  ^bios-(vendor|release-date|version)$:
                    type: string
                    description: DMI type=0 vendor, date, or version
                  ^system-(manufacturer|version|serial-number|product-name|uuid)$:
                    type: string
                    description: |
                      DMI type=1 manufacturer, version, serial, product name
                      or UUID
                  ^baseboard-(manufacturer|version|serial-number|product-name|asset-tag)$:
                    description: |
                      DMI type=2 manufacturer, version, serial,
                      product name or asset tag
                    type: string
                  ^chassis-(manufacturer|version|serial-number|asset-tag)$:
                    description: |
                      DMI type=3 manufacturer, version, serial or asset tag
                    type: string
                  ^oem$:
                    description: List of OEM strings, DMI type=11
                    type: array
                    items:
                      type: string
                additionalProperties: false
            required:
            - mem
            - base
            additionalProperties: false
        additionalProperties: false
      gnss:
        description: GNSS configuration
        oneOf:
        - type: array
          deprecated: true
          items:
            type: object
            properties:
              port:
                $ref: "#/definitions/portNumber"
              ifname:
                $ref: "#/definitions/interfaceName"
            required:
            - port
            additionalProperties: false
        - type: object
          properties:
            proxy:
              description: GNSS proxy configurations
              type: object
              properties:
                tcp:
                  description: GNSS TCP NMEA proxy configuration
                  type: array
                  items:
                    type: object
                    properties:
                      port:
                        description: TCP port to create proxy service on
                        $ref: "#/definitions/portNumber"
                      ifname:
                        description: Interface to bind TCP proxy to
                        $ref: "#/definitions/interfaceName"
                    required:
                    - port
                    additionalProperties: false
                udp:
                  description: GNSS UDP proxy configuration
                  type: array
                  items:
                    type: object
                    properties:
                      port:
                        description: |
                          UDP destination port to send NMEA datagrams to
                        $ref: "#/definitions/portNumber"
                      ifname:
                        description: Interface to send datagrams over
                        $ref: "#/definitions/interfaceName"
                      dst:
                        description: IP address to send NMEA datagrams to
                        $ref: "#/definitions/ip46Address"
                    required:
                    - port
                    - dst
                    additionalProperties: false
              additionalProperties: false
          additionalProperties: false
      itxpt:
        description: ITxPT service configuration
        type: object
        patternProperties:
          ^((lan|sfp|wfi|br|vxl|veth|vmtap)[0-9]+(\.[0-9]+)?|(lan[0-9]+(\.(rej|acc[0-9]*))))$:
            description: Interface name to provide service on
            type: object
            properties:
              services:
                description: List of services to start
                type: object
                properties:
                  apc:
                    description: Automatic Passenger Count service
                    type: object
                    additionalProperties: false
                  inventory:
                    description: Inventory service
                    type: object
                    properties:
                      http:
                        description: Port of HTTP/XML server
                        $ref: "#/definitions/portNumber"
                    additionalProperties: false
                  gnsslocation:
                    description: GNSSLocation service configuration
                    type: object
                    properties:
                      port:
                        description: UDP destination port
                        default: 14005
                        $ref: "#/definitions/portNumber"
                      group:
                        description: Multicast destination
                        default: 239.255.42.21
                        $ref: "#/definitions/ip46Address"
                    additionalProperties: false
                  time:
                    description: SNTP time service configuration
                    type: object
                    properties:
                      sntp-host:
                        description: IP address of the (S)NTP server
                        $ref: "#/definitions/ip46Address"
                    required:
                    - sntp-host
                    additionalProperties: false
                required:
                - inventory  # mandatory in the ITxPT standard
                additionalProperties: false
            required:
            - services
            additionalProperties: false
        minProperties: 1
        additionalProperties: false
      users:
        description: Unix users configuration
        type: object
        properties:
          local:
            description: Local Unix users
            type: object
            patternProperties:
              ^[a-zA-Z0-9]+$:
                description: User name
                type: object
                properties:
                  password:
                    description: Encrypted password (using MD5 or SHA-256/512)
                    type: string
                    pattern: ^\$(1|5|6)\$[a-zA-Z0-9./]+\$[a-zA-Z0-9./]+$|^\$(5|6)\$rounds=[0-9]+\$[a-zA-Z0-9./]+\$[a-zA-Z0-9./]+$
                required:
                - password
                additionalProperties: false
            additionalProperties: false
        additionalProperties: false
      snmp:
        description: SNMP configuration
        type: object
        properties:
          agent:
            description: Agent configuration
            type: object
            patternProperties:
              ^((lan|sfp|wfi|br|vxl|lo|vrf|veth|vmtap|xfrm)[0-9]*(\.[0-9]+)?|(lan[0-9]+(\.(rej|acc[0-9]*))))$:
                description: Interface name to add configuration to
                type: object
                properties:
                  hostname:
                    description: Hostname snmpd reports as SysName
                    type: string
                    pattern: ^[a-zA-Z0-9\-\.:]{1,64}$
                  users:
                    description: SNMP users
                    type: array
                    items:
                      type: object
                      properties:
                        user:
                          description: User name
                          type: string
                        password:
                          description: Plain password
                          type: string
                          minLength: 8
                      required:
                      - user
                      additionalProperties: false
                additionalProperties: false
            additionalProperties: false
        additionalProperties: false
      radv:
        description: Router Advertisement Daemon
        type: object
        patternProperties:
          ^((lan|sfp|wfi|br|vxl|veth|vmtap)[0-9]+(\.[0-9]+)?|(lan[0-9]+(\.(rej|acc[0-9]*))))$:
            description: Interface to add configuration to
            type: object
            properties:
              router:
                description: Act as default router
                default: false
                type: boolean
              prefixes:
                description: List of IPv6 prefixes to advertise
                type: object
                patternProperties:
                  ^([0-9a-f]{0,4}:){2,7}[0-9a-f]{0,4}/[0-9]{1,3}$:
                    type: object
                    properties:
                      slaac:
                        description: Allow StateLess Address AutoConfiguration
                        default: false
                        type: boolean
                    additionalProperties: false
                additionalProperties: false
              nameservers:
                description: List of nameservers to advertise
                type: array
                items:
                  $ref: "#/definitions/ip6Address"
            additionalProperties: false
        additionalProperties: false
      imu:
        description: Inertial Measurement Unit configuration
        type: object
        properties:
          orientation:
            description: IMU orientation correction
            type: object
            patternProperties:
              ^(x|y|z)$:
                description: Rotation along x/y/z-axis, in degrees
                type: integer
                minimum: -180
                maximum: 180
            additionalProperties: false
          dead-reckoning:
            description: Dead-reckoning configuration
            type: object
            properties:
              dynamic-model:
                description: Dynamic platform model
                default: automotive
                type: string
                enum:
                - automotive
                - scooter
                - railway
            additionalProperties: false
        additionalProperties: false
      logging:
        description: Logging configuration
        type: object
        patternProperties:
          ^[a-zA-Z0-9\-\._~:]+$:
            description: Arbitrary logging configuration name
            type: object
            properties:
              output:
                description: Log output configuration
                type: object
                properties:
                  file:
                    description: Log to local file
                    type: object
                    properties:
                      path:
                        description: Filename to write to
                        type: string
                      size:
                        description: |
                          Size limit of file before rotating it, in bytes
                        type: integer
                        minimum: 0
                      keep:
                        description: Number of rotated files to keep
                        type: integer
                        minimum: 0
                    additionalProperties: false
                    required:
                    - path
                  rsyslog:
                    description: Remote syslog configuration
                    type: object
                    properties:
                      server:
                        description: |
                          Syslog server hostname or IP address to log to
                        type: string
                      port:
                        description: Syslog server port
                        default: 514
                        $ref: "#/definitions/portNumber"
                      hostname:
                        description: Local hostname to include in messages
                        type: string
                      ifname:
                        description: Interface name to bind client socket to
                        $ref: "#/definitions/interfaceName"
                    additionalProperties: false
                    required:
                    - server
                minProperties: 1
                additionalProperties: false
              levels:
                description: |
                  Log level filtering configuration, using syslog priority
                  numbers
                type: object
                patternProperties:
                  ^default$:
                    description: Level to log up to for unspecified subsystems
                    type: integer
                    minimum: 0
                    maximum: 7
                  ^[a-zA-Z0-9\-\._~:]+$:
                    description: Level to log up to for a specific subsystem
                    type: integer
                    minimum: 0
                    maximum: 7
                minProperties: 1
                additionalProperties: false
            additionalProperties: false
            required:
            - output
            - levels
        additionalProperties: false
      multicast:
        description: Multicast routing configuration
        type: object
        properties:
          reflect:
            description: Multicast reflection configurations
            type: array
            items:
              type: object
              properties:
                ifname:
                  description: Input interface to listen for multicasts
                  $ref: "#/definitions/interfaceName"
                group:
                  description: Multicast group to forward
                  $ref: "#/definitions/ipAddress"
                output:
                  description: List of interfaces to forward multicast to
                  type: array
                  minItems: 1
                  items:
                    $ref: "#/definitions/interfaceName"
              required:
              - ifname
              - group
              - output
              additionalProperties: false
        additionalProperties: false
      network-tests:
        description: Network tests configuration
        type: object
        oneOf:
        - properties:
            client:
              description: Client configurations
              type: object
              patternProperties:
                ^[a-zA-Z0-9\-\._~:]+$:
                  description: Test definition with arbitrary name
                  $ref: "#/definitions/networkTestClient"
              additionalProperties: false
            server:
              description: Server instances
              type: array
              items:
                type: object
                properties:
                  ifname:
                    description: Interface to bind server to
                    $ref: "#/definitions/interfaceName"
                additionalProperties: false
          additionalProperties: false
        - patternProperties:
            ^[a-zA-Z0-9\-\._~:]+$:
              $ref: "#/definitions/networkTestClient"
          deprecated: true
          additionalProperties: false
      service-check:
        description: External Service Monitoring
        type: object
        properties:
          http:
            description: Check web servers using HTTP(S) GET requests
            type: object
            patternProperties:
              ^https?:\/\/(www\.)?[-a-zA-Z0-9@:%._\+~#=]{1,256}\.[a-zA-Z0-9()]{1,6}\b([-a-zA-Z0-9()@:%_\+.~#?&//=]*): # HTTP(S) URL https://stackoverflow.com/a/3809435
                type: object
                properties:
                  interval:
                    description: Interval to check service, in seconds
                    type: integer
                    minimum: 1
                  ifname:
                    description: Network interface over which to check
                    $ref: "#/definitions/interfaceName"
                required:
                - interval
                additionalProperties: false
            additionalProperties: false
          icmp:
            description: Check services using ICMP echo requests (ping)
            type: object
            patternProperties:
              ^([0-9]{1,3}\.){3}[0-9]{1,3}|([0-9a-f]{0,4}:){2,7}[0-9a-f]{0,4}$: # IPv4/v6
                type: object
                properties:
                  interval:
                    description: Interval to check service, in seconds
                    type: integer
                    minimum: 1
                  ifname:
                    description: Network interface over which to check
                    $ref: "#/definitions/interfaceName"
                required:
                - interval
                additionalProperties: false
            additionalProperties: false
          snmp:
            description: Check services using SNMP GetRequest to query OIDs
            type: object
            patternProperties:
              ^([0-9]{1,3}\.){3}[0-9]{1,3}|([0-9a-f]{0,4}:){2,7}[0-9a-f]{0,4}$: # IPv4/v6
                description: External service target IPv4/6 address to check
                type: object
                properties:
                  oids:
                    description: List of OIDs to query
                    type: array
                    uniqueItems: true
                    items:
                      type: object
                      properties:
                        oid:
                          description: Numerical OID string
                          type: string
                          pattern: ^([0-2])((\.0)|(\.[1-9][0-9]*))*$ # OID
                        interval:
                          description: Interval to check OID in, in seconds
                          type: integer
                          minimum: 1
                      required:
                      - oid
                  interval:
                    description: Interval of checks, if not specified per OID
                    type: integer
                    minimum: 1
                  ifname:
                    description: Network interface over which to check
                    $ref: "#/definitions/interfaceName"
                  community:
                    description: Community string to use
                    default: public
                    type: string
                required:
                - interval
                - oids
                additionalProperties: false
            additionalProperties: false
        additionalProperties: false
      lldp:
        description: LLDP configuration
        type: object
        patternProperties:
          ^[a-zA-Z0-9\-\._~:]+$:
            type: object
            description: Arbitrary configuration name
            properties:
              interfaces:
                description: List of interfaces to enable LLDP on
                type: array
                items:
                  type: string
                  pattern: ^((lan|sfp|wfi|br|vxl|veth|vmtap)[0-9]*(\.[0-9]+)?|(lan[0-9]+(\.(rej|acc[0-9]*))))$
              snmp:
                description: |
                  SNMP agent configuration name to provide LLDP MIB under
                type: string
                pattern: ^((lan|sfp|wfi|br|vxl|lo|vrf|veth|vmtap|xfrm)[0-9]*(\.[0-9]+)?|(lan[0-9]+(\.(rej|acc[0-9]*))))$
              hostname:
                description: Hostname to report as LLDP SysName
                type: string
                pattern: ^[a-zA-Z0-9\-\.:]{1,64}$
            additionalProperties: false
        additionalProperties: false
      nac:
        description: Network Access Control configuration
        type: object
        patternProperties:
          ^[a-zA-Z0-9\-\._~:]+$:
            description: Configuration with arbitrary name
            type: object
            properties:
              method:
                description: Authentication method, omit for both
                type: string
                enum:
                - mab
                - eap
              ports:
                description: List of access port interfaces to configure NAC on
                type: array
                items:
                  type: string
                  pattern: ^((lan|sfp|vmtap)[0-9]+)$
                minItems: 1
                maxItems: 8
              policy-map:
                description: Map of policy to ifname suffixes
                type: object
                patternProperties:
                  ^accept$:
                    description: Accept policy interface suffix
                    type: string
                    pattern: ^acc[0-9]*$
                  ^reject$:
                    description: Reject policy interface suffix
                    enum:
                    - rej
                  ^vlanid:[0-9]+$:
                    description: VLAN to ifname suffix map for VLAN ID
                    type: string
                    pattern: ^acc[0-9]*$
                minProperties: 1
                maxProperties: 16
                additionalProperties: false
              radius:
                description: RADIUS Authentication information
                type: object
                properties:
                  nasid:
                    description: NAS-ID name to use in RADIUS requests
                    type: string
                  client-addr:
                    description: IP address used for RADIUS client
                    $ref: "#/definitions/ipAddress"
                  client-dev:
                    description: Interface name to bind RADIUS socket to
                    type: string
                  degrade:
                    description: Non-responsive server degrade time, in s
                    type: integer
                    minimum: 0
                  message-auth:
                    description: Require Message-Authenticator attribute
                    default: false
                    type: boolean
                  servers:
                    description: List of RADIUS authentication servers
                    type: array
                    items:
                      type: object
                      properties:
                        server:
                          description: IP address of the RADIUS server
                          $ref: "#/definitions/ipAddress"
                        secret:
                          description: Secret for RADIUS server authentication
                          type: string
                      required:
                      - server
                      - secret
                      additionalProperties: false
                    minItems: 1
                    maxItems: 4
                required:
                - servers
                - nasid
                additionalProperties: false
            required:
            - ports
            - policy-map
            - radius
            additionalProperties: false
        additionalProperties: false
      link:
        description: Link mode and alias name configuration
        type: object
        patternProperties:
          ^((vrf|mbm|wfi|br|vxl|xfrm|veth|vmtap)[0-9]+(\.[0-9]+)?|((vmtap|lan)[0-9]+(\.(rej|acc[0-9]*)))|(br|lan|sfp)[0-9]+(\.[0-9]+))$:
            description: Configuration for other interfaces
            type: object
            properties:
              alias:
                description: Interface alias name
                type: string
                minLength: 1
                maxLength: 256
            additionalProperties: false
          ^(sfp)[0-9]+$:
            description: SFP interface configuration
            type: object
            properties:
              alias:
                description: Interface alias name
                type: string
                minLength: 1
                maxLength: 256
              up:
                description: Administrative interface state
                default: true
                type: boolean
              mtu:
                description: Maximum transmission unit in bytes
                type: integer
                minimum: 576
                maximum: 1500
            additionalProperties: false
          ^(lan)[0-9]+$:
            description: Ethernet interface configuration
            type: object
            properties:
              alias:
                description: Interface alias name
                type: string
                minLength: 1
                maxLength: 256
              up:
                description: Administrative interface state
                default: true
                type: boolean
              mtu:
                description: Maximum transmission unit in bytes
                type: integer
                minimum: 576
                maximum: 1500
              poe:
                description: Power over Ethernet settings
                type: object
                properties:
                  pse:
                    description: |
                      Power Sourcing Equipment, false to disable powering the Power Sourcing Equipment port
                    default: true
                    type: boolean
                required:
                - pse
                additionalProperties: false
              modes:
                description: Enabled Ethernet link speed/duplex modes
                type: array
                items:
                  type: object
                  properties:
                    speed:
                      description: Link speed in Mbit/s
                      type: integer
                      enum: [10, 100, 1000, 10000]
                    half-duplex:
                      description: Use half- instead of full-duplex mode
                      default: false
                      type: boolean
                  required:
                  - speed
                  additionalProperties: false
            additionalProperties: false
        additionalProperties: false
      system:
        description: System settings
        type: object
        properties:
          hostname:
            description: Global hostname to use
            type: string
            pattern: ^[a-zA-Z0-9\-\.:]{1,64}$
        additionalProperties: false
      io:
        description: IO configuration
        type: object
        properties:
          state:
            description: IO pin states configuration
            type: object
            patternProperties:
              ^(g403-slot[0-9]{1})$:
                description: IO module to configure
                type: object
                patternProperties:
                  ^([1-4]{2})$:
                    $ref: "#/definitions/ioPinState"
                additionalProperties: false
            additionalProperties: false
        additionalProperties: false
    additionalProperties: false
  conditional:
    type: array
    items:
      type: object
      properties:
        if:
          $ref: "#/definitions/conditionItem"
        then:
          oneOf:
          - $ref: "#/definitions/netconfItems"
          - $ref: "#/definitions/conditional"
        else:
          oneOf:
          - $ref: "#/definitions/netconfItems"
          - $ref: "#/definitions/conditional"
      required:
      - if
      additionalProperties: false
  conditionItem:
    type: object
    properties:
      geofenced:
        description: Geofencing check using GNSS position
        type: object
        properties:
          zones:
            description: |
              Geofencing zones as annotated in the geometry using the
              `geofence-zone` property. Condition is true if the device is
              inside any of the zones.
            type: array
            items:
              type: string
            minItems: 1
        required:
        - zones
        additionalProperties: false
      io-state:
        description: IO pin state check
        $ref: "#/definitions/ioModulePin"
        unevaluatedProperties: false
      vpn:
        description: VPN tunnel check
        type: object
        properties:
          tunnel:
            description: Name of VPN tunnel, as in in `vpn` subsystem `tunnels`
            type: string
        required:
        - tunnel
        additionalProperties: false
      fan-error:
        description: Cooling fan error check
        type: object
        additionalProperties: false
    additionalProperties: false
    minProperties: 1
    maxProperties: 1
properties:
  unconditional:
    $ref: "#/definitions/netconfItems"
  conditional:
    $ref: "#/definitions/conditional"
required:
- unconditional
additionalProperties: false
