# /etc/dhcpd.conf - fw.internal
# Layout: .1 firewall, .2-.9 infra, .10-.149 fixed, .150-.199 pool (only where useful)

option domain-name "internal";
default-lease-time 86400;
max-lease-time 86400;

# ADMIN - wired admin laptop
subnet 192.168.1.0 netmask 255.255.255.0 {
	option routers 192.168.1.1;
	option domain-name-servers 192.168.1.1;
	option ntp-servers 192.168.1.1;
	range 192.168.1.150 192.168.1.199;
	host laptop { hardware ethernet @MAC@; fixed-address 192.168.1.10; }
}

# APMGMT - access point only, no pool
subnet 192.168.2.0 netmask 255.255.255.0 {
	option routers 192.168.2.1;
	option domain-name-servers 192.168.2.1;
	option ntp-servers 192.168.2.1;
	host unifi-ap { hardware ethernet @MAC@; fixed-address 192.168.2.2; }
}

# PS5 - no pool
subnet 192.168.3.0 netmask 255.255.255.0 {
	option routers 192.168.3.1;
	option domain-name-servers 9.9.9.9, 149.112.112.112;
	option ntp-servers 192.168.3.1;
	host ps5 { hardware ethernet @MAC@; fixed-address 192.168.3.10; }
}

# MEDIA - no pool
subnet 192.168.4.0 netmask 255.255.255.0 {
	option routers 192.168.4.1;
	option domain-name-servers 192.168.4.1;
	option ntp-servers 192.168.4.1;
	host kodi { hardware ethernet @MAC@; fixed-address 192.168.4.10; }
}

# SERVERS - cluster, UniFi host, Home Assistant; no pool
subnet 192.168.5.0 netmask 255.255.255.0 {
	option routers 192.168.5.1;
	option domain-name-servers 192.168.5.1;
	option ntp-servers 192.168.5.1;
	host k8s-cp1        { hardware ethernet @MAC@; fixed-address 192.168.5.10; }
	host k8s-cp2        { hardware ethernet @MAC@; fixed-address 192.168.5.20; }
	host k8s-cp3        { hardware ethernet @MAC@; fixed-address 192.168.5.30; }
	host k8s-worker1    { hardware ethernet @MAC@; fixed-address 192.168.5.40; }
	host k8s-worker2    { hardware ethernet @MAC@; fixed-address 192.168.5.50; }
	host unifi          { hardware ethernet @MAC@; fixed-address 192.168.5.60; }
	host homeassistant  { hardware ethernet @MAC@; fixed-address 192.168.5.140; }
}

# TRUSTED - phones and laptop on Wi-Fi
subnet 192.168.10.0 netmask 255.255.255.0 {
	option routers 192.168.10.1;
	option domain-name-servers 192.168.10.1;
	option ntp-servers 192.168.10.1;
	range 192.168.10.150 192.168.10.199;
	host laptop-wifi { hardware ethernet @MAC@; fixed-address 192.168.10.10; }
	host phone { hardware ethernet @MAC@; fixed-address 192.168.10.11; }
	host watch { hardware ethernet @MAC@; fixed-address 192.168.10.12; }
}

# IOT - pool for new IoT devices, client isolation on the SSID
subnet 192.168.20.0 netmask 255.255.255.0 {
	option routers 192.168.20.1;
	option domain-name-servers 192.168.20.1;
	option ntp-servers 192.168.20.1;
	range 192.168.20.150 192.168.20.199;
	host vacuum { hardware ethernet @MAC@; fixed-address 192.168.20.10; }
}

# GUEST - visitors, pool only
subnet 192.168.30.0 netmask 255.255.255.0 {
	option routers 192.168.30.1;
	option domain-name-servers 9.9.9.9, 149.112.112.112;
	option ntp-servers 192.168.30.1;
	range 192.168.30.150 192.168.30.199;
}