# Minimal two-interface Pebble router: DHCP on the WAN, a /24 LAN,
# DHCP and recursive DNS for clients, NAT, and SSH from the LAN only.
#
# Replace igb0/igb1 with the devices listed by 'pebble interfaces'.
version: 1

system:
  hostname: pebble
  timezone: Europe/London

network:
  wan:
    device: igb0
    ipv4:
      mode: dhcp

  lan:
    device: igb1
    ipv4:
      address: 192.168.10.1/24

  ipv6:
    mode: disabled

dhcp:
  enabled: true
  authoritative: true
  start: 192.168.10.100
  end: 192.168.10.199
  lease_duration: 12h
  domain: home.arpa

dns:
  enabled: true
  recursive: true
  dnssec: true
  cache_mb: 32

  blocking:
    enabled: true
    response: nxdomain
    update_interval: 24h
    max_domains: 250000
    lists: []
    allowlist: []
    denylist: []

wireguard:
  interfaces: []

firewall:
  default_inbound: deny
  default_forward: deny
  default_outbound: allow

  nat:
    enabled: true
    outbound: wan

management:
  ssh:
    enabled: true
    allow_from:
      - 192.168.10.0/24

updates:
  automatic_install: false

recovery:
  rollback_timeout: 120s
  keep_generations: 5