@takodotid/circuit 0.40.0 → 0.42.0

package/src/platforms/junos/bgp.ts

@@ -6,7 +6,7 @@ import type { Device, Family, Neighbor, NeighborSettings, PolicyRule } from "../
 import { JunosRender, type JunosStatements } from "./render";
 
 type AnyRule = PolicyRule<string, string>;
-type AnyNeighbor = Neighbor<string, string>;
+type AnyNeighbor = Neighbor<string, string, string>;
 
 /** BGP sessions, the policies they use, prefix sets and RPKI servers, added to one device's statements. */
 export class JunosBgp {
@@ -41,7 +41,7 @@ export class JunosBgp {
     }
 
     /** A neighbor's settings with its group's beneath them. */
-    static settingsOf(device: Device, neighbor: AnyNeighbor): NeighborSettings<string> {
+    static settingsOf(device: Device, neighbor: AnyNeighbor): NeighborSettings<string, string> {
         const group = neighbor.group ? device.routing?.bgp?.groups?.[neighbor.group] : undefined;
         return { ...group, ...neighbor };
     }

package/src/platforms/routeros/TRAPS.md

@@ -63,3 +63,7 @@ Behaviour that looks like something else. Each one has been hit on a real device
 - `use-bfd=no`, set on a connection that had `use-bfd=yes`, is printed by the export; it is the default, and the plan sets it to take BFD off.
 - No MAC learning limit on 7.23.5: `/interface bridge port` has `learn` but no limit, and `/interface ethernet switch port` has none (CCR2216). `mac_limit` stays refused.
 - A switch rule matches a kind of frame with `mac-protocol` (`ip`, `ipv6`, `arp` among 23 kinds), but cannot match "not" one. An ethertype filter is a rule that lets each kind through and a last one with an empty `new-dst-ports` for the rest, after the port's ACL rules, which match only `ip` or `ipv6`. Four such rules on a free port took the router to 70 switch rules, none invalid (CCR2216, 7.23.5).
+- A routing table holds no routes the router forwards by unless it has `fib`: `/routing table add fib name=...`. The export prints the flag between the properties, `add comment=... fib name=...`.
+- A BGP connection's `routing-table` installs what it learns in that table and not in main; the next hop still resolves through main. Proved on a CCR2216 on 7.23.5 with a session to a test speaker: its routes showed `routing-table=<table>`, active, and main kept only its own static route. The export prints `routing-table` only when it is not `main`.
+- `/routing rule` is an ordered list without names, like a filter chain, and the plan rewrites it whole in the config's order. `lookup-only-in-table` drops a packet its table has no route for (a ping printed `no route`); `lookup` routes it by main instead (the ping left). An interface to match is `interface=`. A `drop` or `unreachable` rule is printed with `!realm`, which Circuit does not write (CCR2216, 7.23.5).
+- An eBGP connection to an address on no connected network, without `multihop=yes`, takes the TCP connection, logs `connection <local> from <remote>`, and closes it with no OPEN and nothing else in the log, even with `bgp,debug` logging on (CCR2216, 7.23.5).

package/src/platforms/routeros/export.ts

@@ -137,6 +137,7 @@ export class RouterOsExport {
     /** Menus whose entries are an ordered list without names. They are rewritten whole, in the order the render gives. */
     static readonly ORDERED = new Set([
         "/routing filter rule",
+        "/routing rule",
         "/ip firewall filter",
         "/ipv6 firewall filter",
         "/ip firewall nat",

package/src/platforms/routeros/index.ts

@@ -207,7 +207,16 @@ export class RouterOs extends Platform {
         }
 
         // BFD on a static route and a MAC limit are refused above, for the reason the device gave, and an ethertype filter on a LAG as unproved.
-        found.push(...Derive.unproved(device, ["bfd-timers", "multihop-bfd", "static-route-bfd", "mac-limit", "ethertype-filter"]));
+        found.push(
+            ...Derive.unproved(device, [
+                "bfd-timers",
+                "multihop-bfd",
+                "static-route-bfd",
+                "mac-limit",
+                "ethertype-filter",
+                "routing-tables",
+            ])
+        );
 
         return found;
     }
@@ -549,7 +558,7 @@ export class RouterOs extends Platform {
 
         return down.map((bgp) =>
             bgp.limit
-                ? `BGP session ${bgp.neighbor} was established before the apply and closed on its limit${bgp.limit.max !== undefined ? ` of ${bgp.limit.max} prefixes` : ""}: the neighbor sends more than it may. Find out why, then: circuit bgp ${device.name} ${bgp.neighbor} --clear-limit`
+                ? `BGP session ${bgp.neighbor} was established before the apply and closed on its limit${bgp.limit.max !== undefined ? ` of ${bgp.limit.max} prefixes` : ""}: the neighbor sends more than it may. Find out why, then: circuit bgp ${device.name} --neighbors '^${bgp.neighbor}$' --clear-limit`
                 : `BGP session ${bgp.neighbor} was established before the apply and is not ${limits.seconds} s after it (${bgp.reason ?? (bgp.uptime === "no session" ? "no session" : "not established")}). Look with: circuit bgp ${device.name} --log`
         );
     }

package/src/platforms/routeros/plan.ts

@@ -30,6 +30,9 @@ export class RouterOsPlan {
         "/interface bridge filter",
         "/interface list",
         "/ip vrf",
+        // Routes, rules and BGP connections name a table, so it exists first.
+        "/routing table",
+        "/routing rule",
         "/ip address",
         "/ipv6 address",
         "/ip pool",

package/src/platforms/routeros/render.ts

@@ -32,7 +32,7 @@ export type AnyInterface = Interface<string, string>;
 
 type Speed = NonNullable<AnyPort["speed"]>;
 type AnyRule = PolicyRule<string, string>;
-type AnyNeighbor = Neighbor<string, string>;
+type AnyNeighbor = Neighbor<string, string, string>;
 
 /** One device's render: the device, and the commands collected under their menu. */
 export class RouterOsRender {
@@ -1101,6 +1101,8 @@ export class RouterOsRender {
     }
 
     private routing(): void {
+        this.routingTables();
+        this.routingRules();
         this.staticRoutes();
         this.rpki();
         if (this.device.routing?.bgp) {
@@ -1113,6 +1115,28 @@ export class RouterOsRender {
         this.bfd();
     }
 
+    /** A table beside the main one. `fib` puts its routes in the forwarding table, so traffic can be routed by them. */
+    private routingTables(): void {
+        for (const [name, table] of Object.entries(this.device.routing?.tables ?? {})) {
+            this.add("/routing table", "add fib", { comment: table.description, name });
+        }
+    }
+
+    /** Rules in the order written. `lookup-only-in-table` drops what the table has no route for, and `lookup` falls back to the main table. */
+    private routingRules(): void {
+        for (const rule of this.device.routing?.rules ?? []) {
+            const onlyInTable = rule.table !== "main" && (rule.fallback ?? "none") === "none";
+            this.add("/routing rule", "add", {
+                action: onlyInTable ? "lookup-only-in-table" : "lookup",
+                comment: rule.description,
+                "dst-address": rule.match?.dst,
+                interface: rule.match?.in_interface && this.name(rule.match.in_interface),
+                "src-address": rule.match?.src,
+                table: rule.table,
+            });
+        }
+    }
+
     private staticRoutes(): void {
         for (const route of this.device.routing?.static ?? []) {
             const menu = Address.family(Address.host(route.prefix)) === "ipv4" ? "/ip route" : "/ipv6 route";
@@ -1123,7 +1147,7 @@ export class RouterOsRender {
                 distance: route.distance,
                 "dst-address": route.prefix,
                 gateway,
-                "routing-table": route.vrf,
+                "routing-table": route.vrf ?? route.table,
             });
         }
     }
@@ -1146,7 +1170,7 @@ export class RouterOsRender {
     }
 
     /** A neighbor's settings with its group's beneath them. */
-    private settingsOf(neighbor: AnyNeighbor): NeighborSettings<string> {
+    private settingsOf(neighbor: AnyNeighbor): NeighborSettings<string, string> {
         const group = neighbor.group ? this.device.routing?.bgp?.groups?.[neighbor.group] : undefined;
         return { ...group, ...neighbor };
     }
@@ -1268,6 +1292,7 @@ export class RouterOsRender {
                 "output.network": originates ? RouterOsRender.NETWORKS[family] : undefined,
                 "remote.address": `${neighbor.address}/${addressFamily === "ipv4" ? 32 : 128}`,
                 "remote.as": settings.remote_as,
+                "routing-table": settings.table,
                 "tcp-md5-key": settings.password && Secrets.marker(settings.password),
                 "use-bfd": settings.bfd ? "yes" : undefined,
             });

package/src/schema/device.ts

@@ -71,7 +71,7 @@ export type Vrf = {
 /**
  * Everything one device runs. What is not written here is removed from the device or returned to its default.
  *
- * Type parameters are the names the device declares, so a reference to a name that does not exist fails to compile: N ports, V VLANs, I interfaces, P policies, S prefix sets, G BGP groups, A ACLs, AS address sets, U users, F VRFs, C certificates.
+ * Type parameters are the names the device declares, so a reference to a name that does not exist fails to compile: N ports, V VLANs, I interfaces, P policies, S prefix sets, G BGP groups, A ACLs, AS address sets, U users, F VRFs, C certificates, T routing tables.
  */
 export type Device<
     Pl extends string = string,
@@ -87,6 +87,7 @@ export type Device<
     U extends string = string,
     F extends string = string,
     C extends string = string,
+    T extends string = string,
 > = {
     /** Hostname. */
     name: string;
@@ -112,8 +113,8 @@ export type Device<
     interfaces?: Record<I, Interface<NoInfer<V>, NoInfer<F>>>;
     /** Separate routing tables, keyed by name. */
     vrfs?: Record<F, Vrf>;
-    /** Static routes, BGP, OSPF and route validation. */
-    routing?: Routing<NoInfer<P>, G, NoInfer<I | N>, NoInfer<F>>;
+    /** Routing tables and rules, static routes, BGP, OSPF and route validation. */
+    routing?: Routing<NoInfer<P>, G, NoInfer<I | N>, NoInfer<F>, T>;
     /** Route policies, keyed by name. */
     policies?: Record<P, RoutePolicy<NoInfer<P>, NoInfer<S>>>;
     /** Prefix sets that policies match on, keyed by name. */

package/src/schema/firewall.ts

@@ -104,7 +104,11 @@ export type Firewall<I extends string, AS extends string> = {
     };
     /** Helpers that run. None when absent. */
     helpers?: readonly Helper[];
-    /** Traffic to and from these prefixes passes without connection tracking. A flood toward them cannot fill the connection table, and rules see its packets in the state `untracked`. An address NAT uses inside one stays tracked, or its replies would never be translated back. Everything is tracked when absent. */
+    /**
+     * Traffic to and from these prefixes passes without connection tracking. A flood toward them cannot fill the connection table, and rules see its packets in the state `untracked`. Everything is tracked when absent.
+     *
+     * Each address NAT uses inside one of these prefixes (a source translation's `to`, a destination translation's `to` or matched `dst`) stays tracked: Circuit writes two accept rules for it, one for traffic to it and one for traffic from it, before the untracked rules. Without them, a reply to that address would skip tracking and never be translated back.
+     */
     untracked?: readonly Prefix[];
 };
 

package/src/schema/interfaces.ts

@@ -113,7 +113,7 @@ export type Port<V extends string, A extends string, L extends string, F extends
         acl?: A;
         /** The LAG this port is in. Every other setting goes on the LAG. */
         lag?: L;
-        /** Another of our devices at the other end of the cable. Without a `description`, the port is described from it: the far device and the far port as printed on it, such as `firewall-1 port6`. */
+        /** Another of our devices at the other end of the cable. */
         link?: Link;
     };
 

package/src/schema/policy.ts

@@ -83,15 +83,23 @@ export type Sets = {
 };
 
 /**
- * One step of a route policy. Evaluated in this order: `call`, then `match`, then `set`, then `action`.
- *
- * A rule without `action` changes the route and moves on to the next rule.
+ * Run another policy at this point. A route it accepts or rejects stops there; any other route goes on to the next rule. A call holds nothing else: to call a policy for some routes only, put the match inside that policy.
  */
-export type PolicyRule<P extends string, S extends string> = {
+export type CallRule<P extends string> = {
     /** Shown beside the rule on the device. */
     description?: string;
-    /** Evaluate another policy first. A route it accepts or rejects stops there. */
-    call?: P;
+    /** The policy to run. */
+    call: P;
+    match?: never;
+    set?: never;
+    action?: never;
+};
+
+/** Change and decide on the routes that match. A rule without `action` changes the route and moves on to the next rule. */
+export type MatchRule<S extends string> = {
+    /** Shown beside the rule on the device. */
+    description?: string;
+    call?: never;
     /** Which routes the rule applies to. Every route when absent. */
     match?: Match<S>;
     /** What to change on a matching route. */
@@ -100,5 +108,8 @@ export type PolicyRule<P extends string, S extends string> = {
     action?: "accept" | "reject";
 };
 
+/** One step of a route policy: a call to another policy, or a rule that matches routes, changes them and may decide on them. */
+export type PolicyRule<P extends string, S extends string> = CallRule<P> | MatchRule<S>;
+
 /** Rules evaluated in order, first decision wins. A route no rule accepts is rejected. */
 export type RoutePolicy<P extends string, S extends string> = readonly PolicyRule<P, S>[];

package/src/schema/routing.ts

@@ -1,7 +1,7 @@
 import type { Family, IP, Prefix, Secret } from "./common";
 
 /** A route the device has without learning it. */
-export type StaticRoute<I extends string, F extends string> = {
+export type StaticRoute<I extends string, F extends string, T extends string = never> = {
     /** Destination. */
     prefix: Prefix;
     /** Next-hop address. */
@@ -14,8 +14,10 @@ export type StaticRoute<I extends string, F extends string> = {
     bfd?: true;
     /** Preference against other routes to the same prefix. Lower wins. 1 when absent. */
     distance?: number;
-    /** The VRF the route is in. The default table when absent. */
+    /** The VRF the route is in. The main table when absent. */
     vrf?: F;
+    /** The table the route is in, one of `routing.tables`. The main table when absent. A route has a `vrf` or a `table`, not both. */
+    table?: T;
     /** Why the route exists. */
     description?: string;
 };
@@ -26,7 +28,7 @@ export type StaticRoute<I extends string, F extends string> = {
 export type BgpRole = "provider" | "customer" | "peer" | "rs" | "rs-client";
 
 /** Settings a BGP neighbor can set itself or take from its group. */
-export type NeighborSettings<P extends string> = {
+export type NeighborSettings<P extends string, T extends string = never> = {
     /** The neighbor's AS. Our own AS makes the session internal. */
     remote_as?: number;
     /** Who the neighbor is. */
@@ -55,10 +57,12 @@ export type NeighborSettings<P extends string> = {
     passive?: boolean;
     /** Detect a dead link in under a second with BFD. */
     bfd?: boolean;
+    /** The table the routes learned are installed in, one of `routing.tables`. The main table when absent. What is announced still comes from `networks` and the main table. */
+    table?: T;
 };
 
 /** One BGP session. Settings it does not set come from its group. */
-export type Neighbor<P extends string, G extends string> = NeighborSettings<P> & {
+export type Neighbor<P extends string, G extends string, T extends string = never> = NeighborSettings<P, T> & {
     /** The neighbor's address. */
     address: IP;
     /** The group this neighbor takes a setting from when it does not set that setting itself. */
@@ -66,15 +70,15 @@ export type Neighbor<P extends string, G extends string> = NeighborSettings<P> &
 };
 
 /** BGP on this device. */
-export type Bgp<P extends string, G extends string> = {
+export type Bgp<P extends string, G extends string, T extends string = never> = {
     /** Our AS number. */
     asn: number;
     /** Prefixes this device originates. Each needs a route, for example a static blackhole. Export policy still decides who receives them. */
     networks?: readonly Prefix[];
     /** Settings shared by several neighbors, keyed by group name. */
-    groups?: Record<G, NeighborSettings<P>>;
+    groups?: Record<G, NeighborSettings<P, T>>;
     /** Sessions keyed by name. */
-    neighbors?: Record<string, Neighbor<P, G>>;
+    neighbors?: Record<string, Neighbor<P, G, T>>;
 };
 
 /** How fast BFD notices a dead neighbor: after `multiplier` packets in a row are missed, so in `interval` times `multiplier` milliseconds. */
@@ -120,14 +124,46 @@ export type Ospf<I extends string> = {
     redistribute?: readonly ("connected" | "static")[];
 };
 
+/** A routing table beside the main one. It holds no interfaces: routes go in from static routes and BGP neighbors that name it in `table`, and `routing.rules` send traffic to it. */
+export type RoutingTable = {
+    /** What the table is for. */
+    description?: string;
+};
+
+/** Traffic a routing rule matches: all of what is given. Every packet when absent. */
+export type RoutingRuleMatch<I extends string> = {
+    /** Source prefix. */
+    src?: Prefix;
+    /** Destination prefix. */
+    dst?: Prefix;
+    /** The interface the traffic arrives on. */
+    in_interface?: I;
+};
+
+/** One routing rule: traffic it matches is routed by `table` instead of the main table. */
+export type RoutingRule<I extends string, T extends string> = {
+    /** Why the rule exists. */
+    description?: string;
+    /** What the traffic must match. Every packet when absent, so such a rule is the last one. */
+    match?: RoutingRuleMatch<I>;
+    /** The table that routes the traffic: one of `routing.tables`, or `main`. */
+    table: T | "main";
+    /** When `table` has no route for a packet: `none` drops it as unroutable, `main` routes it by the main table instead. `none` when absent. Not for a rule whose table is `main`. */
+    fallback?: "none" | "main";
+};
+
 /** Routing on this device. */
-export type Routing<P extends string, G extends string, I extends string, F extends string> = {
+export type Routing<P extends string, G extends string, I extends string, F extends string, T extends string = never> = {
     /** Identifies this router to its neighbors. */
     router_id?: IP;
+    /** Routing tables beside the main one, keyed by name. Not `main`, and not the name of a VRF. */
+    tables?: Record<T, RoutingTable>;
+    /** Rules that route matching traffic by another table, such as traffic from one block by its own transits' default. In order: the first that matches decides, and traffic no rule matches is routed by the main table. */
+    rules?: readonly RoutingRule<I, NoInfer<T>>[];
     /** Routes the device has without learning them. */
-    static?: readonly StaticRoute<I, F>[];
+    static?: readonly StaticRoute<I, F, NoInfer<T>>[];
     /** BGP sessions and what they exchange. */
-    bgp?: Bgp<P, G>;
+    bgp?: Bgp<P, G, NoInfer<T>>;
     /** OSPF areas and interfaces. */
     ospf?: Ospf<I>;
     /** Validators answering route origin validation. */

package/templates/colocation/checks.ts

@@ -3,6 +3,7 @@
 import type { Check, Finding } from "@takodotid/circuit";
 import { Address } from "@takodotid/circuit";
 import { Checks } from "@takodotid/circuit/helpers";
+import { blocksOf, type Tenant } from "./tenancy";
 import { TENANTS } from "./tenants";
 
 export default [
@@ -15,21 +16,27 @@ export default [
     // A native VLAN stays on one trunk and nowhere else, or it joins every trunk it is native on.
     Checks.nativeVlansAreDeadEnds,
 
-    // Tenants never share a name, a number, an address or a port. A port given twice would go to the last tenant alone.
+    // Tenants never share a name, a VLAN, an address or a port. A port given twice would go to the last tenant alone.
     () => {
         const findings: Finding[] = [];
         const error = (message: string) => findings.push({ level: "error", message });
+        const vlansOf = (t: Tenant) => [t.internet.vlan, ...(t.private ? [t.private.vlan] : [])];
 
         TENANTS.forEach((t, index) => {
             for (const other of TENANTS.slice(index + 1)) {
                 if (other.name === t.name) error(`tenant ${t.name} is declared twice`);
-                if (other.number === t.number) error(`tenants ${t.name} and ${other.name} share number ${t.number}`);
 
-                for (const block of t.blocks) {
-                    const clash = other.blocks.find(
-                        ({ prefix }) => Address.contains(prefix, block.prefix) || Address.contains(block.prefix, prefix)
-                    );
-                    if (clash) error(`${block.prefix} of ${t.name} overlaps ${clash.prefix} of ${other.name}`);
+                for (const vlan of vlansOf(t)) {
+                    for (const theirs of vlansOf(other)) {
+                        if (theirs.id === vlan.id)
+                            error(`VLAN ${vlan.id} is both ${vlan.name} of ${t.name} and ${theirs.name} of ${other.name}`);
+                        if (theirs.name === vlan.name) error(`VLAN ${vlan.name} is declared by both ${t.name} and ${other.name}`);
+                    }
+                }
+
+                for (const block of blocksOf(t)) {
+                    const clash = blocksOf(other).find((prefix) => Address.contains(prefix, block) || Address.contains(block, prefix));
+                    if (clash) error(`${block} of ${t.name} overlaps ${clash} of ${other.name}`);
                 }
             }
 
@@ -39,10 +46,6 @@ export default [
                     if (sharer) error(`port ${port} on ${device} is given to both ${t.name} and ${sharer.name}`);
                 }
             }
-
-            for (const { prefix, gateway } of t.blocks) {
-                if (!Address.contains(prefix, gateway)) error(`the gateway ${gateway} of ${t.name} is outside ${prefix}`);
-            }
         });
 
         return findings;

package/templates/colocation/edge-01.ts

@@ -6,7 +6,7 @@ import type { Prefix } from "@takodotid/circuit";
 import { defineDevice, secret, Utils } from "@takodotid/circuit";
 import { Bgp, Filters } from "@takodotid/circuit/helpers";
 import { ASN, communities } from "./routing";
-import { edgeRules, gateways, internetVlanNames, internetVlans } from "./tenancy";
+import { edgeRules, gateways, internetVlanNames, routerVlans } from "./tenancy";
 import { TENANTS } from "./tenants";
 
 /** The address space this router announces. */
@@ -34,7 +34,7 @@ export default defineDevice({
             transit: { id: 300, description: "IP transit from Hurricane Electric, AS6939" },
             ix: { id: 200, description: "Peering LAN of SGIX" },
         },
-        internetVlans(TENANTS)
+        routerVlans(TENANTS)
     ),
 
     ports: {

package/templates/colocation/tenancy.ts

@@ -1,94 +1,73 @@
-// What a tenant is, and what each device carries for it. A tenant's file says what is the tenant's own; its VLANs and names follow from its name and number.
+// What a tenant is, and what each device carries for it. A tenant's file writes everything its devices carry: its VLANs, the router's addresses for it, its ports. These functions only gather them for one device.
 
-import type { AclRule, Interface, IP, Port, Prefix, Vlan } from "@takodotid/circuit";
+import type { AclRule, Interface, InterfaceAddress, Port, Prefix, Vlan } from "@takodotid/circuit";
 import { Address } from "@takodotid/circuit";
 
-/** A tenant's networks. `internet` carries its servers' public addresses and reaches the router. `private` connects its own servers to each other and stays on the switches. */
-type TenantNetwork = "internet" | "private";
-
-export type Tenant<N extends string = string> = {
-    /** Lowercase, and never reused. Names everything the tenant has. */
-    name: N;
-    /** A number no other tenant has. Its internet VLAN is 1000 + number, its private VLAN 2000 + number. */
-    number: number;
-    /** Public blocks routed to the tenant. `gateway` is the router's address inside the block, which the tenant's servers use as their gateway. */
-    blocks: readonly { prefix: Prefix; gateway: IP }[];
+/** A VLAN with its name. */
+export type NamedVlan = Vlan & { name: string };
+
+export type Tenant = {
+    /** Lowercase, and never reused. */
+    name: string;
+    /** The tenant's VLAN to the internet. The router has it, with the tenant's gateways, and so does every switch, to carry it up to the router. */
+    internet: {
+        vlan: NamedVlan;
+        /** The router's addresses on it, each the gateway the tenant's servers use inside one of its blocks, such as `198.51.100.9/29`. */
+        gateways: readonly InterfaceAddress[];
+    };
+    /** A VLAN between the tenant's own servers. It is only on a switch where one of the tenant's ports uses it, and never on the router. */
+    private?: { vlan: NamedVlan };
     /** Rules for traffic toward the tenant's IPv4 blocks from the transit and the exchange, such as a cap on UDP. Everything reaches the tenant when absent. */
     acl?: readonly (Omit<AclRule<never>, "match"> & { match?: Omit<NonNullable<AclRule<never>["match"]>, "vlan" | "dst"> })[];
-    /** The tenant's ports, by switch, then by port. A port in `private` gives the tenant a private network on that switch. */
-    ports: Readonly<
-        Record<string, Readonly<Record<string, { description: string; access?: TenantNetwork; trunk?: readonly TenantNetwork[] }>>>
-    >;
+    /** The tenant's ports, by switch, then by port, written as any port is. */
+    ports: Readonly<Record<string, Readonly<Record<string, Port<string, string, string, string>>>>>;
 };
 
-/** Declare a tenant. */
-export const tenant = <const N extends string>(spec: Tenant<N>): Tenant<N> => spec;
-
-const internetVlan = <N extends string>(t: Tenant<N>) => `${t.name}-internet` as const;
-const privateVlan = <N extends string>(t: Tenant<N>) => `${t.name}-private` as const;
+/** A VLAN as `vlans` takes it, keyed by its name. */
+const entry = ({ name, ...vlan }: NamedVlan): [string, Vlan] => [name, vlan];
 
-/** Every tenant's internet VLAN. The router has them all, and so does each switch, to carry them up to the router. */
-export const internetVlans = <N extends string>(tenants: readonly Tenant<N>[]) =>
-    Object.fromEntries(tenants.map((t) => [internetVlan(t), { id: 1000 + t.number, description: `Tenant ${t.name} internet` }])) as Record<
-        `${N}-internet`,
-        Vlan
-    >;
+/** The tenant's blocks: the network of each gateway. */
+export const blocksOf = (t: Tenant): Prefix[] => t.internet.gateways.map((gateway) => Address.prefixOf(gateway));
 
-/** The names of every tenant's internet VLAN, for a trunk toward the router. */
-export const internetVlanNames = <N extends string>(tenants: readonly Tenant<N>[]) => tenants.map(internetVlan);
+/** Every tenant's internet VLAN, for the router. */
+export const routerVlans = (tenants: readonly Tenant[]): Record<string, Vlan> =>
+    Object.fromEntries(tenants.map((t) => entry(t.internet.vlan)));
 
-/** The private VLANs one switch has: those of tenants with a port on it in their private network. */
-export const privateVlans = <N extends string>(tenants: readonly Tenant<N>[], device: string) =>
+/** The VLANs one switch carries: every tenant's internet VLAN, and the private VLAN of each tenant with a port on it that uses it. */
+export const switchVlans = (tenants: readonly Tenant[], device: string): Record<string, Vlan> =>
     Object.fromEntries(
-        tenants
-            .filter((t) =>
-                Object.values(t.ports[device] ?? {}).some((port) => port.access === "private" || port.trunk?.includes("private"))
-            )
-            .map((t) => [privateVlan(t), { id: 2000 + t.number, description: `Tenant ${t.name} private` }])
-    ) as Record<`${N}-private`, Vlan>;
-
-/** The tenants' ports on one switch. */
-export function portsOn<N extends string>(tenants: readonly Tenant<N>[], device: string) {
-    const ports: Record<string, Port<`${N}-internet` | `${N}-private`, string, string, string>> = {};
-
-    for (const t of tenants) {
-        const vlanOf = (network: TenantNetwork) => (network === "internet" ? internetVlan(t) : privateVlan(t));
+        tenants.flatMap((t) => {
+            const ports = Object.values(t.ports[device] ?? {});
+            const usesPrivate =
+                t.private &&
+                ports.some((port) => port.access_vlan === t.private!.vlan.name || port.trunk_vlans?.includes(t.private!.vlan.name));
+            return [entry(t.internet.vlan), ...(usesPrivate ? [entry(t.private!.vlan)] : [])];
+        })
+    );
 
-        for (const [name, { access, trunk, description }] of Object.entries(t.ports[device] ?? {})) {
-            ports[name] = {
-                description,
-                ...(access ? { access_vlan: vlanOf(access) } : {}),
-                ...(trunk ? { trunk_vlans: trunk.map(vlanOf) } : {}),
-            };
-        }
-    }
+/** The names of every tenant's internet VLAN, for a trunk toward the router. */
+export const internetVlanNames = (tenants: readonly Tenant[]) => tenants.map((t) => t.internet.vlan.name);
 
-    return ports;
-}
+/** The tenants' ports on one switch. */
+export const portsOn = (tenants: readonly Tenant[], device: string): Record<string, Port<string, string, string, string>> =>
+    Object.assign({}, ...tenants.map((t) => t.ports[device] ?? {}));
 
 /** The router's interface on each tenant's internet VLAN, holding the tenant's gateways. */
-export function gateways<N extends string>(tenants: readonly Tenant<N>[]) {
-    const interfaces = {} as Record<`${N}-internet`, Interface<`${N}-internet`, never>>;
-
-    for (const t of tenants) {
-        interfaces[internetVlan(t)] = {
-            type: "vlan",
-            vlan: internetVlan(t),
-            description: `Tenant ${t.name}`,
-            addresses: t.blocks.map(({ prefix, gateway }): Prefix => `${gateway}/${Address.split(prefix).len}`),
-        };
-    }
-
-    return interfaces;
-}
+export const gateways = (tenants: readonly Tenant[]): Record<string, Interface<string, never>> =>
+    Object.fromEntries(
+        tenants.map((t) => [
+            t.internet.vlan.name,
+            { type: "vlan", vlan: t.internet.vlan.name, description: `Tenant ${t.name}`, addresses: t.internet.gateways },
+        ])
+    );
 
 /** Each tenant's `acl` rules on one VLAN from outside, one per rule and IPv4 block, each limited to traffic toward that block. */
 export const edgeRules = <V extends string>(tenants: readonly Tenant[], vlan: V): AclRule<V>[] =>
     tenants.flatMap((t) =>
         (t.acl ?? []).flatMap((rule) =>
-            t.blocks
-                .filter(({ prefix }) => Address.family(prefix) === "ipv4")
-                .map(({ prefix }) => ({
+            blocksOf(t)
+                .filter((prefix) => Address.family(prefix) === "ipv4")
+                .map((prefix) => ({
                     ...rule,
                     ...(rule.description ? { description: `${vlan}: ${rule.description}` } : {}),
                     match: { ...rule.match, vlan, dst: prefix },

package/templates/colocation/tenants/acme.ts

@@ -1,19 +1,19 @@
 // An example tenant. Copy this file for each new tenant, and add it to index.ts.
 
-import { tenant } from "../tenancy";
+import type { Tenant } from "../tenancy";
 
-export default tenant({
+export default {
     name: "acme",
-    number: 1,
-    blocks: [
-        { prefix: "198.51.100.8/29", gateway: "198.51.100.9" },
-        { prefix: "2001:db8:100:1::/64", gateway: "2001:db8:100:1::1" },
-    ],
+    internet: {
+        vlan: { name: "acme-internet", id: 1001, description: "Tenant acme internet" },
+        gateways: ["198.51.100.9/29", "2001:db8:100:1::1/64"],
+    },
+    private: { vlan: { name: "acme-private", id: 2001, description: "Tenant acme private" } },
     acl: [{ description: "UDP to acme above 1G", match: { protocol: "udp" }, action: "accept", rate: "1G" }],
     ports: {
         "tor-01": {
-            "10g-1": { description: "acme server 1", trunk: ["internet", "private"] },
-            "10g-2": { description: "acme server 2", trunk: ["internet", "private"] },
+            "10g-1": { description: "acme server 1", trunk_vlans: ["acme-internet", "acme-private"] },
+            "10g-2": { description: "acme server 2", trunk_vlans: ["acme-internet", "acme-private"] },
         },
     },
-});
+} satisfies Tenant;

package/templates/colocation/tenants/index.ts

@@ -1,5 +1,6 @@
 // Every tenant. A tenant joins by being added here, and leaves by being removed: the next apply takes away everything it had.
 
+import type { Tenant } from "../tenancy";
 import acme from "./acme";
 
-export const TENANTS = [acme] as const;
+export const TENANTS: readonly Tenant[] = [acme];

package/templates/colocation/tor-01.ts

@@ -1,7 +1,7 @@
 // The top-of-rack switch: the tenants' servers, and one uplink to the router.
 
 import { defineDevice, secret, Utils } from "@takodotid/circuit";
-import { internetVlanNames, internetVlans, portsOn, privateVlans } from "./tenancy";
+import { internetVlanNames, portsOn, switchVlans } from "./tenancy";
 import { TENANTS } from "./tenants";
 
 export default defineDevice({
@@ -17,7 +17,7 @@ export default defineDevice({
     lldp: true,
     stp: {},
 
-    vlans: Utils.merge({ mgmt: { id: 99, description: "Management" } }, internetVlans(TENANTS), privateVlans(TENANTS, "tor-01")),
+    vlans: Utils.merge({ mgmt: { id: 99, description: "Management" } }, switchVlans(TENANTS, "tor-01")),
 
     // Every tenant's ports, from its file in tenants/, beside the switch's own.
     ports: Utils.merge(portsOn(TENANTS, "tor-01"), {