@takodotid/circuit 0.43.1 → 1.0.0-rc.2

package/templates/colocation/edge-01.ts

@@ -1,133 +0,0 @@
-// The edge router: BGP with an IP transit and an internet exchange, the gateway of every tenant, and the filter between them.
-//
-// Hurricane Electric and SGIX stand for your own transit and exchange. Addresses are from the documentation ranges; use the ones your providers give you.
-
-import type { Prefix } from "@takodotid/circuit";
-import { defineDevice, secret, Utils } from "@takodotid/circuit";
-import { Bgp, Filters } from "@takodotid/circuit/helpers";
-import { ASN, communities } from "./routing";
-import { edgeRules, gateways, internetVlanNames, routerVlans } from "./tenancy";
-import { TENANTS } from "./tenants";
-
-/** The address space this router announces. */
-const OURS = ["198.51.100.0/24", "2001:db8:100::/48"] as const satisfies readonly Prefix[];
-
-/** Where the router is managed from. */
-const MANAGEMENT = "10.0.0.0/24" satisfies Prefix;
-
-/** Sources that never arrive from the internet: our own space, and addresses that are not on the internet at all. */
-const SPOOFED = [OURS[0], ...Filters.MARTIANS, ...Filters.PRIVATE_RANGES];
-
-export default defineDevice({
-    name: "edge-01",
-    platform: "routeros",
-    model: "CCR2216-1G-12XS-2XQ",
-    connection: { host: "10.0.0.1", user: "operator" },
-    users: { operator: { role: "admin", password: secret("EDGE_01_PASSWORD") } },
-
-    system: { timezone: "Asia/Jakarta", ntp: { servers: ["pool.ntp.org"] } },
-    management: { allow: [MANAGEMENT], ssh: {} },
-
-    vlans: Utils.merge(
-        {
-            mgmt: { id: 99, description: "Management of the switches" },
-            transit: { id: 300, description: "IP transit from Hurricane Electric, AS6939" },
-            ix: { id: 200, description: "Peering LAN of SGIX" },
-        },
-        routerVlans(TENANTS)
-    ),
-
-    ports: {
-        "1g-1": { description: "Management", addresses: ["10.0.0.1/24"] },
-        "25g-1": { description: "Hurricane Electric", access_vlan: "transit", acl: "edge" },
-        "25g-2": { description: "SGIX", access_vlan: "ix", acl: "edge" },
-        "100g-1": {
-            description: "tor-01",
-            speed: "40g",
-            trunk_vlans: ["mgmt", ...internetVlanNames(TENANTS)],
-            link: { device: "tor-01", port: "40g-1" },
-        },
-    },
-
-    interfaces: Utils.merge(
-        {
-            mgmt: { type: "vlan", vlan: "mgmt", addresses: ["10.0.99.1/24"] },
-            transit: { type: "vlan", vlan: "transit", addresses: ["203.0.113.2/30"] },
-            ix: { type: "vlan", vlan: "ix", addresses: ["192.0.2.10/24", "2001:db8:ffff::10/64"] },
-        },
-        gateways(TENANTS)
-    ),
-
-    routing: {
-        router_id: "203.0.113.2",
-        // A route for each block we announce, so it is in the table even when nothing inside it is up.
-        static: OURS.map((prefix) => ({ prefix, blackhole: true, description: "Originate" })),
-        bgp: {
-            asn: ASN,
-            networks: [...OURS],
-            neighbors: {
-                "hurricane-electric": {
-                    address: "203.0.113.1",
-                    remote_as: 6939,
-                    role: "provider",
-                    import: "TRANSIT-IN",
-                    export: "OUT",
-                    max_prefixes: 1_200_000,
-                },
-                "sgix-rs-v4": {
-                    address: "192.0.2.1",
-                    remote_as: 55518,
-                    role: "rs",
-                    import: "IX-IN",
-                    export: "OUT",
-                    max_prefixes: 100_000,
-                },
-                "sgix-rs-v6": {
-                    address: "2001:db8:ffff::1",
-                    remote_as: 55518,
-                    role: "rs",
-                    import: "IX-IN",
-                    export: "OUT",
-                    max_prefixes: 50_000,
-                },
-            },
-        },
-    },
-
-    policies: {
-        SANITY: Bgp.sanity(),
-        // A route from the exchange is preferred over the same route from the transit: higher local preference wins.
-        "TRANSIT-IN": [{ call: "SANITY" }, communities.tag("transit", 6939), { set: { local_pref: 100 } }, { action: "accept" }],
-        "IX-IN": [{ call: "SANITY" }, communities.tag("exchange", 55518), { set: { local_pref: 200 } }, { action: "accept" }],
-        OUT: [
-            ...OURS.map((prefix) => ({ description: `Announce ${prefix}`, match: { prefix }, action: "accept" as const })),
-            { description: "Nothing else leaves", action: "reject" },
-        ],
-    },
-
-    firewall: {
-        address_sets: { "bgp-neighbors": ["203.0.113.1", "192.0.2.1", "2001:db8:ffff::1"] },
-        filter: {
-            input: {
-                default: "drop",
-                rules: [
-                    { description: "Replies", match: { state: ["established", "related"] }, action: "accept" },
-                    { description: "Ping", match: { protocol: "icmp" }, action: "accept" },
-                    { description: "Management", match: { src: MANAGEMENT }, action: "accept" },
-                    { description: "BGP", match: { protocol: "tcp", dst_port: 179, src_set: "bgp-neighbors" }, action: "accept" },
-                ],
-            },
-            forward: { rules: [...Filters.badTcpFlags()] },
-        },
-    },
-
-    // In the switch chip, before a packet reaches the router's CPU: spoofed sources first, then each tenant's own rules.
-    acls: {
-        edge: [
-            ...Filters.antiSpoofing("transit", SPOOFED),
-            ...Filters.antiSpoofing("ix", SPOOFED),
-            ...edgeRules(TENANTS, "transit"),
-            ...edgeRules(TENANTS, "ix"),
-        ],
-    },
-});

package/templates/colocation/routing.ts

@@ -1,13 +0,0 @@
-// What your network is on the internet: its AS number and its BGP communities.
-
-import { Bgp } from "@takodotid/circuit/helpers";
-
-/** Your AS number. */
-export const ASN = 64500;
-
-/** What your BGP communities mean. The router tags each route it learns with them, and `circuit communities` publishes them. */
-export const communities = Bgp.communityScheme({
-    asn: ASN,
-    learned_from: { function: 1, classes: { transit: 1, exchange: 2 } },
-    learned_from_as: 3,
-});

package/templates/colocation/tenancy.ts

@@ -1,76 +0,0 @@
-// What a tenant is, and what each device carries for it. A tenant's file writes everything its devices carry: its VLANs, the router's addresses for it, its ports. These functions only gather them for one device.
-
-import type { AclRule, Interface, InterfaceAddress, Port, Prefix, Vlan } from "@takodotid/circuit";
-import { Address } from "@takodotid/circuit";
-
-/** A VLAN with its name. */
-export type NamedVlan = Vlan & { name: string };
-
-export type Tenant = {
-    /** Lowercase, and never reused. */
-    name: string;
-    /** The tenant's VLAN to the internet. The router has it, with the tenant's gateways, and so does every switch, to carry it up to the router. */
-    internet: {
-        vlan: NamedVlan;
-        /** The router's addresses on it, each the gateway the tenant's servers use inside one of its blocks, such as `198.51.100.9/29`. */
-        gateways: readonly InterfaceAddress[];
-    };
-    /** A VLAN between the tenant's own servers. It is only on a switch where one of the tenant's ports uses it, and never on the router. */
-    private?: { vlan: NamedVlan };
-    /** Rules for traffic toward the tenant's IPv4 blocks from the transit and the exchange, such as a cap on UDP. Everything reaches the tenant when absent. */
-    acl?: readonly (Omit<AclRule<never>, "match"> & { match?: Omit<NonNullable<AclRule<never>["match"]>, "vlan" | "dst"> })[];
-    /** The tenant's ports, by switch, then by port, written as any port is. */
-    ports: Readonly<Record<string, Readonly<Record<string, Port<string, string, string, string>>>>>;
-};
-
-/** A VLAN as `vlans` takes it, keyed by its name. */
-const entry = ({ name, ...vlan }: NamedVlan): [string, Vlan] => [name, vlan];
-
-/** The tenant's blocks: the network of each gateway. */
-export const blocksOf = (t: Tenant): Prefix[] => t.internet.gateways.map((gateway) => Address.prefixOf(gateway));
-
-/** Every tenant's internet VLAN, for the router. */
-export const routerVlans = (tenants: readonly Tenant[]): Record<string, Vlan> =>
-    Object.fromEntries(tenants.map((t) => entry(t.internet.vlan)));
-
-/** The VLANs one switch carries: every tenant's internet VLAN, and the private VLAN of each tenant with a port on it that uses it. */
-export const switchVlans = (tenants: readonly Tenant[], device: string): Record<string, Vlan> =>
-    Object.fromEntries(
-        tenants.flatMap((t) => {
-            const ports = Object.values(t.ports[device] ?? {});
-            const usesPrivate =
-                t.private &&
-                ports.some((port) => port.access_vlan === t.private!.vlan.name || port.trunk_vlans?.includes(t.private!.vlan.name));
-            return [entry(t.internet.vlan), ...(usesPrivate ? [entry(t.private!.vlan)] : [])];
-        })
-    );
-
-/** The names of every tenant's internet VLAN, for a trunk toward the router. */
-export const internetVlanNames = (tenants: readonly Tenant[]) => tenants.map((t) => t.internet.vlan.name);
-
-/** The tenants' ports on one switch. */
-export const portsOn = (tenants: readonly Tenant[], device: string): Record<string, Port<string, string, string, string>> =>
-    Object.assign({}, ...tenants.map((t) => t.ports[device] ?? {}));
-
-/** The router's interface on each tenant's internet VLAN, holding the tenant's gateways. */
-export const gateways = (tenants: readonly Tenant[]): Record<string, Interface<string, never>> =>
-    Object.fromEntries(
-        tenants.map((t) => [
-            t.internet.vlan.name,
-            { type: "vlan", vlan: t.internet.vlan.name, description: `Tenant ${t.name}`, addresses: t.internet.gateways },
-        ])
-    );
-
-/** Each tenant's `acl` rules on one VLAN from outside, one per rule and IPv4 block, each limited to traffic toward that block. */
-export const edgeRules = <V extends string>(tenants: readonly Tenant[], vlan: V): AclRule<V>[] =>
-    tenants.flatMap((t) =>
-        (t.acl ?? []).flatMap((rule) =>
-            blocksOf(t)
-                .filter((prefix) => Address.family(prefix) === "ipv4")
-                .map((prefix) => ({
-                    ...rule,
-                    ...(rule.description ? { description: `${vlan}: ${rule.description}` } : {}),
-                    match: { ...rule.match, vlan, dst: prefix },
-                }))
-        )
-    );

package/templates/colocation/tenants/acme.ts

@@ -1,19 +0,0 @@
-// An example tenant. Copy this file for each new tenant, and add it to index.ts.
-
-import type { Tenant } from "../tenancy";
-
-export default {
-    name: "acme",
-    internet: {
-        vlan: { name: "acme-internet", id: 1001, description: "Tenant acme internet" },
-        gateways: ["198.51.100.9/29", "2001:db8:100:1::1/64"],
-    },
-    private: { vlan: { name: "acme-private", id: 2001, description: "Tenant acme private" } },
-    acl: [{ description: "UDP to acme above 1G", match: { protocol: "udp" }, action: "accept", rate: "1G" }],
-    ports: {
-        "tor-01": {
-            "10g-1": { description: "acme server 1", trunk_vlans: ["acme-internet", "acme-private"] },
-            "10g-2": { description: "acme server 2", trunk_vlans: ["acme-internet", "acme-private"] },
-        },
-    },
-} satisfies Tenant;

package/templates/colocation/tenants/index.ts

@@ -1,6 +0,0 @@
-// Every tenant. A tenant joins by being added here, and leaves by being removed: the next apply takes away everything it had.
-
-import type { Tenant } from "../tenancy";
-import acme from "./acme";
-
-export const TENANTS: readonly Tenant[] = [acme];

package/templates/colocation/tor-01.ts

@@ -1,33 +0,0 @@
-// The top-of-rack switch: the tenants' servers, and one uplink to the router.
-
-import { defineDevice, secret, Utils } from "@takodotid/circuit";
-import { internetVlanNames, portsOn, switchVlans } from "./tenancy";
-import { TENANTS } from "./tenants";
-
-export default defineDevice({
-    name: "tor-01",
-    platform: "vrp",
-    model: "CE6855-48S6Q-HI",
-    connection: { host: "10.0.99.2", user: "operator" },
-    users: { operator: { role: "admin", password: secret("TOR_01_PASSWORD") } },
-
-    system: { timezone: "Asia/Jakarta", ntp: { servers: ["10.0.99.1"] } },
-    management: { allow: ["10.0.0.0/24"], ssh: {} },
-
-    lldp: true,
-    stp: {},
-
-    vlans: Utils.merge({ mgmt: { id: 99, description: "Management" } }, switchVlans(TENANTS, "tor-01")),
-
-    // Every tenant's ports, from its file in tenants/, beside the switch's own.
-    ports: Utils.merge(portsOn(TENANTS, "tor-01"), {
-        "40g-1": {
-            description: "edge-01",
-            trunk_vlans: ["mgmt", ...internetVlanNames(TENANTS)],
-            link: { device: "edge-01", port: "100g-1" },
-        },
-    }),
-
-    interfaces: { mgmt: { type: "vlan", vlan: "mgmt", addresses: ["10.0.99.2/24"] } },
-    routing: { static: [{ prefix: "0.0.0.0/0", via: "10.0.99.1" }] },
-});

package/templates/edge-router/checks.ts

@@ -1,20 +0,0 @@
-// Rules of your own. `circuit validate` runs them beside Circuit's own, and an error stops `diff` and `apply`.
-
-import type { Check } from "@takodotid/circuit";
-import { Bgp, Checks } from "@takodotid/circuit/helpers";
-
-export default [
-    // Nothing leaves by accident: every export ends by rejecting what it did not accept.
-    Checks.exportsEndInReject,
-
-    // Traffic from the transit and the exchange reaches the rest of the network only through the router.
-    Checks.trustBoundary({ untrusted: ["transit", "ix"], routers: ["edge-01"] }),
-
-    // Every BGP session filters what it takes in.
-    (devices) =>
-        devices.flatMap((device) =>
-            Bgp.neighborPolicies(device)
-                .filter((neighbor) => !neighbor.import)
-                .map((neighbor) => ({ level: "error" as const, device: device.name, message: `${neighbor.name} has no import policy` }))
-        ),
-] satisfies Check[];

package/templates/edge-router/circuit.config.ts

@@ -1,8 +0,0 @@
-// The network: every device Circuit manages, your own checks, and what is published about the network.
-
-import { defineNetwork } from "@takodotid/circuit";
-import checks from "./checks";
-import edge from "./edge-01";
-import { ASN, communities } from "./routing";
-
-export default defineNetwork({ devices: [edge], checks, asn: ASN, communities: communities.catalogue });

package/templates/edge-router/edge-01.ts

@@ -1,110 +0,0 @@
-// The edge router: BGP with an IP transit and an internet exchange, filtered on the way in and on the way out.
-//
-// Hurricane Electric and SGIX stand for your own transit and exchange. Addresses are from the documentation ranges; use the ones your providers give you.
-
-import type { Prefix } from "@takodotid/circuit";
-import { defineDevice, secret } from "@takodotid/circuit";
-import { Bgp, Filters } from "@takodotid/circuit/helpers";
-import { ASN, communities } from "./routing";
-
-/** The address space this router announces. */
-const OURS = ["198.51.100.0/24", "2001:db8:100::/48"] as const satisfies readonly Prefix[];
-
-/** Where the router is managed from. */
-const MANAGEMENT = "10.0.0.0/24" satisfies Prefix;
-
-/** Sources that never arrive from the internet: our own space, and addresses that are not on the internet at all. */
-const SPOOFED = [OURS[0], ...Filters.MARTIANS, ...Filters.PRIVATE_RANGES];
-
-export default defineDevice({
-    name: "edge-01",
-    platform: "routeros",
-    model: "CCR2216-1G-12XS-2XQ",
-    connection: { host: "10.0.0.1", user: "operator" },
-    users: { operator: { role: "admin", password: secret("EDGE_01_PASSWORD") } },
-
-    system: { timezone: "Asia/Jakarta", ntp: { servers: ["pool.ntp.org"] } },
-    management: { allow: [MANAGEMENT], ssh: {} },
-
-    vlans: {
-        transit: { id: 300, description: "IP transit from Hurricane Electric, AS6939" },
-        ix: { id: 200, description: "Peering LAN of SGIX" },
-    },
-
-    ports: {
-        "1g-1": { description: "Management", addresses: ["10.0.0.1/24"] },
-        "25g-1": { description: "Hurricane Electric", access_vlan: "transit", acl: "edge" },
-        "25g-2": { description: "SGIX", access_vlan: "ix", acl: "edge" },
-    },
-
-    interfaces: {
-        transit: { type: "vlan", vlan: "transit", addresses: ["203.0.113.2/30"] },
-        ix: { type: "vlan", vlan: "ix", addresses: ["192.0.2.10/24", "2001:db8:ffff::10/64"] },
-    },
-
-    routing: {
-        router_id: "203.0.113.2",
-        // A route for each block we announce, so it is in the table even when nothing inside it is up.
-        static: OURS.map((prefix) => ({ prefix, blackhole: true, description: "Originate" })),
-        bgp: {
-            asn: ASN,
-            networks: [...OURS],
-            neighbors: {
-                "hurricane-electric": {
-                    address: "203.0.113.1",
-                    remote_as: 6939,
-                    role: "provider",
-                    import: "TRANSIT-IN",
-                    export: "OUT",
-                    max_prefixes: 1_200_000,
-                },
-                "sgix-rs-v4": {
-                    address: "192.0.2.1",
-                    remote_as: 55518,
-                    role: "rs",
-                    import: "IX-IN",
-                    export: "OUT",
-                    max_prefixes: 100_000,
-                },
-                "sgix-rs-v6": {
-                    address: "2001:db8:ffff::1",
-                    remote_as: 55518,
-                    role: "rs",
-                    import: "IX-IN",
-                    export: "OUT",
-                    max_prefixes: 50_000,
-                },
-            },
-        },
-    },
-
-    policies: {
-        SANITY: Bgp.sanity(),
-        // A route from the exchange is preferred over the same route from the transit: higher local preference wins.
-        "TRANSIT-IN": [{ call: "SANITY" }, communities.tag("transit", 6939), { set: { local_pref: 100 } }, { action: "accept" }],
-        "IX-IN": [{ call: "SANITY" }, communities.tag("exchange", 55518), { set: { local_pref: 200 } }, { action: "accept" }],
-        OUT: [
-            ...OURS.map((prefix) => ({ description: `Announce ${prefix}`, match: { prefix }, action: "accept" as const })),
-            { description: "Nothing else leaves", action: "reject" },
-        ],
-    },
-
-    firewall: {
-        address_sets: { "bgp-neighbors": ["203.0.113.1", "192.0.2.1", "2001:db8:ffff::1"] },
-        filter: {
-            input: {
-                default: "drop",
-                rules: [
-                    { description: "Replies", match: { state: ["established", "related"] }, action: "accept" },
-                    { description: "Ping", match: { protocol: "icmp" }, action: "accept" },
-                    { description: "Management", match: { src: MANAGEMENT }, action: "accept" },
-                    { description: "BGP", match: { protocol: "tcp", dst_port: 179, src_set: "bgp-neighbors" }, action: "accept" },
-                ],
-            },
-            forward: { rules: [...Filters.badTcpFlags()] },
-        },
-    },
-
-    // In the switch chip, before a packet reaches the router's CPU.
-    acls: { edge: [...Filters.antiSpoofing("transit", SPOOFED), ...Filters.antiSpoofing("ix", SPOOFED)] },
-});

package/templates/edge-router/routing.ts

@@ -1,13 +0,0 @@
-// What your network is on the internet: its AS number and its BGP communities.
-
-import { Bgp } from "@takodotid/circuit/helpers";
-
-/** Your AS number. */
-export const ASN = 64500;
-
-/** What your BGP communities mean. The router tags each route it learns with them, and `circuit communities` publishes them. */
-export const communities = Bgp.communityScheme({
-    asn: ASN,
-    learned_from: { function: 1, classes: { transit: 1, exchange: 2 } },
-    learned_from_as: 3,
-});

package/templates/project/AGENTS.md

@@ -1,51 +0,0 @@
-# AGENTS.md
-
-This repository describes a computer network with [Circuit](https://circuit.tako.id). Each network device, such as a router or a switch, has a TypeScript file that says how it should be configured. Circuit compares that file with what the device runs, and changes the device to match.
-
-You are helping the owner of this network. Changes you make here can take a network down, so work carefully and let the owner decide.
-
-## How Circuit works
-
-1. `circuit.config.ts` lists every device and the checks to run.
-2. Each device file calls `defineDevice`. What the file says is everything the device runs: a port, a user or a service that the file does not mention is removed or turned off when the device is applied.
-3. A field is only written when it has a value. There is no `enabled: false`; leave a field out to turn it off.
-4. Secrets are never written in a file. A file says `secret("NAME")`, and the value comes from `.env` or the environment. Never put a password, a key or a token in any other file, and never print one.
-5. `.circuit/` is written by Circuit. Never edit it. `.circuit/state/` holds what each device ran when Circuit last read it.
-
-What each field means is written as a comment on the field, in `node_modules/@takodotid/circuit/src/schema/`. Read it before using a field you have not used before. The documentation is at https://circuit.tako.id.
-
-## Commands
-
-| Command                                        | What it does                                                                  | Changes a device |
-| ---------------------------------------------- | ----------------------------------------------------------------------------- | ---------------- |
-| `npx circuit validate`                         | Checks every file and every rule in the checks                                | no               |
-| `npx circuit diff [device]`                    | Shows what would change, compared with the last snapshot                      | no               |
-| `npx circuit build <device>`                   | Prints the full configuration the device should run                           | no               |
-| `npx circuit snapshot [device]`                | Reads what each device runs now into `.circuit/state/`                        | no, only reads   |
-| `npx circuit show <device> '<command>'`        | Runs commands that only read on the device, secrets hidden                    | no, only reads   |
-| `npx circuit bgp [device] --neighbors <regex>` | Each BGP neighbor in the config next to its live session: up or down          | no, only reads   |
-| `npx circuit console <device> '<line>'`        | Sends lines to the device's serial console, unchecked                         | **can**          |
-| `npx circuit apply <device>`                   | Reads the device, then shows what would change on it                          | no               |
-| `npx circuit apply <device> --confirm`         | Sends the change to the device                                                | **yes**          |
-| `npx circuit secrets`                          | Lists every secret the config uses, and whether each one can be read          | no               |
-| `npx circuit rename <device> <new-name>`       | Shows every line a new device name changes; `--confirm` writes them           | no               |
-| `npx circuit addresses`                        | Every address the config uses, by prefix, and what is still free              | no               |
-| `npx circuit graph --layer=all --format=json`  | The whole network as a graph: cables, VLANs, addresses, BGP, OSPF and tunnels | no               |
-
-## Making a change
-
-1. Edit the device's file.
-2. Run `npx circuit validate`. Fix every error.
-3. Run `npx circuit diff <device>` and read the result.
-4. Show the owner what will change and why, in plain words.
-5. Run `npx circuit apply <device>` to see the plan against the live device.
-6. **Stop.** Only run `apply <device> --confirm` after the owner says yes to that exact plan. Never confirm on your own, even if you were told to finish the task.
-7. After the apply, commit the device file together with the updated `.circuit/state/`.
-
-## Rules
-
-- Never run `apply --confirm`, `refresh --confirm` or `peeringdb --confirm`, or `console` with a line that changes something, without the owner's explicit approval for that run.
-- If a plan removes something you did not expect, stop and ask. It usually means the file is missing something the device needs.
-- Be careful with anything that carries your own access to the device: the management address, the management VLAN, the uplink, `management.allow`, and the login user. A mistake there locks everyone out.
-- A platform supports only the OS versions listed at https://circuit.tako.id/platforms/. Before the first apply to a device, check that it runs one of them.
-- When you are not sure what a field does, or what the owner wants, ask instead of guessing.

package/templates/project/CLAUDE.md

@@ -1 +0,0 @@
-@AGENTS.md

package/templates/project/README.md

@@ -1,16 +0,0 @@
-# Network
-
-This repository describes the network with [Circuit](https://circuit.tako.id). Each device has a file; Circuit makes the device match it.
-
-```bash
-npm install                     # once
-npx circuit secrets             # check every secret can be read
-npx circuit validate            # check the files
-npx circuit studio              # see the network in the browser
-npx circuit snapshot            # read what each device runs now
-npx circuit diff                # see what would change
-npx circuit apply <device>      # see the plan against the device
-npx circuit apply <device> --confirm
-```
-
-Secrets go in `.env`, which is never committed. `.circuit/` is written by Circuit; commit it, but never edit it.

package/templates/project/gitignore

@@ -1,5 +0,0 @@
-node_modules/
-
-# Secrets, or references to them. Never commit these.
-.env
-*.key.pem

package/templates/project/tsconfig.json

@@ -1,13 +0,0 @@
-{
-    "compilerOptions": {
-        "lib": ["ESNext"],
-        "target": "ESNext",
-        "module": "ESNext",
-        "moduleResolution": "bundler",
-        "types": ["node"],
-        "strict": true,
-        "noEmit": true,
-        "skipLibCheck": true,
-        "verbatimModuleSyntax": true
-    }
-}

package/templates/single-site/checks.ts

@@ -1,26 +0,0 @@
-// Rules of your own. `circuit validate` runs them beside Circuit's own, and an error stops `diff` and `apply`.
-
-import type { Check } from "@takodotid/circuit";
-import { Checks } from "@takodotid/circuit/helpers";
-
-export default [
-    // A port without a description is hard to trace later. A warning, so it does not block anything.
-    (devices) =>
-        devices.flatMap((device) =>
-            Object.entries(device.ports ?? {})
-                .filter(([, port]) => port && !port.description)
-                .map(([name]) => ({ level: "warning" as const, device: device.name, message: `port ${name} has no description` }))
-        ),
-
-    // Someone plugging into a wall socket must not land on the management network. Only a trunk between devices carries it.
-    (devices) =>
-        devices.flatMap((device) =>
-            Object.entries(device.ports ?? {})
-                .filter(([, port]) => port?.access_vlan && Checks.vlansOf(port).includes("mgmt"))
-                .map(([name]) => ({
-                    level: "error" as const,
-                    device: device.name,
-                    message: `port ${name} gives management to whatever plugs in`,
-                }))
-        ),
-] satisfies Check[];

package/templates/single-site/circuit.config.ts

@@ -1,8 +0,0 @@
-// The network: every device Circuit manages, and your own checks.
-
-import { defineNetwork } from "@takodotid/circuit";
-import checks from "./checks";
-import router from "./router";
-import sw from "./switch";
-
-export default defineNetwork({ devices: [router, sw], checks });