egress:
  owner_vm: vm101
  default_policy: user_sticky
  first_provider: hidemyname
  preserve_wan: true
  preserve_dnat: true

  routing:
    mark_base_hex: "0x200"
    table_base: 200
    legacy_table: 200
    legacy_rules:
      - priority: 10019
        match: "iif eth1"
        table: 200
      - priority: 10020
        match: "from 10.200.0.0/24"
        table: 200

  providers:
    hidemyname:
      type: hidemyname_awg
      max_active_slots: 5
      # STEP_030C: HMN adapter source model.
      # /root/hmn/configs/awg1/latest is currently empty on VM101.
      # Use validated TSV cache outputs as provider input.
      candidate_source: /root/hmn/cache/ok-awg1-strict-foreign-latest.tsv
      selected_source: /root/hmn/cache/selected-awg1-latest.tsv
      fallback_candidate_source: /root/hmn/cache/ok-awg1-strict-all-latest.tsv
      quarantine_source: /root/hmn/cache/quarantine-awg1-latest.tsv
      legacy_empty_config_dir: /root/hmn/configs/awg1/latest
      existing_tools_root: /root/hmn
      adapter_future_path: /opt/router-ops/product/egress/adapters/hidemyname
      notes:
        - "Old cron automation must be disabled before new manager owns slots."
        - "Do not exceed provider active slot limit."

  slots:
    - id: hmn_slot_1
      iface: vpn1
      table: 201
      fwmark: "0x201"
      provider: hidemyname
      role: active
      weight: 100

    - id: hmn_slot_2
      iface: vpn2
      table: 202
      fwmark: "0x202"
      provider: hidemyname
      role: active
      weight: 100

    - id: hmn_slot_3
      iface: vpn3
      table: 203
      fwmark: "0x203"
      provider: hidemyname
      role: active
      weight: 100

    - id: hmn_slot_4
      iface: vpn4
      table: 204
      fwmark: "0x204"
      provider: hidemyname
      role: active
      weight: 100

    - id: hmn_slot_5
      iface: vpn5
      table: 205
      fwmark: "0x205"
      provider: hidemyname
      role: active
      weight: 100

  excluded_legacy_interfaces:
    - vpn_user
    - vpn_test
