# Copyright 2026 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

# yaml-language-server: $schema=../../../../../schemas/vpn.schema.json

name: to-onprem
region: $locations:primary
peer_gateways:
  default:
    external:
      redundancy_type: SINGLE_IP_INTERNALLY_REDUNDANT
      interfaces:
        - 8.8.8.8
router_config:
  create: false
  name: $routers:hub/hybrid-connectivity-router
tunnels:
  remote-0:
    bgp_peer:
      address: 169.254.128.1
      asn: 64513
      # Uncomment to enable custom route advertisements for this BGP peer. (see https://docs.cloud.google.com/network-connectivity/docs/router/concepts/advertised-routes#am-custom)
      # custom_advertise:
      #   all_subnets: true
      #   ip_ranges:
      #     "10.0.0.0/8": "rfc1918-10"
      #     "172.16.0.0/12": "rfc1918-172"
      #     "192.168.0.0/16": "rfc1918-192"
      #     # Uncomment to advertise the Cloud DNS query source address range. (see https://docs.cloud.google.com/dns/docs/server-policies-overview#altns-targets:~:text=0/19-,Type%202%20name%20server,-An%20IP%20address)
      #     "35.199.192.0/19": "cloud-dns-resolver"
      #     # Uncomment to advertise the Private Google Access routes. (see https://docs.cloud.google.com/vpc/docs/private-google-access-hybrid)
      #     "199.36.153.8/30": "private-googleapis-com"
      #     # Uncomment to advertise the Private Google Access routes that support VPC Service Controls. (see https://docs.cloud.google.com/vpc/docs/private-google-access-hybrid)
      #     "199.36.153.4/30": "restricted-googleapis-com"
    bgp_session_range: "169.254.128.2/30"
    peer_external_gateway_interface: 0
    shared_secret: "mySecret"
    vpn_gateway_interface: 0
  remote-1:
    bgp_peer:
      address: 169.254.128.5
      asn: 64513
      # Uncomment to enable custom route advertisements for this BGP peer. (see https://docs.cloud.google.com/network-connectivity/docs/router/concepts/advertised-routes#am-custom)
      # custom_advertise:
      #   all_subnets: true
      #   ip_ranges:
      #     "10.0.0.0/8": "rfc1918-10"
      #     "172.16.0.0/12": "rfc1918-172"
      #     "192.168.0.0/16": "rfc1918-192"
      #     # Uncomment to advertise the Cloud DNS query source address range. (see https://docs.cloud.google.com/dns/docs/server-policies-overview#altns-targets:~:text=0/19-,Type%202%20name%20server,-An%20IP%20address)
      #     "35.199.192.0/19": "cloud-dns-resolver"
      #     # Uncomment to advertise the Private Google Access routes. (see https://docs.cloud.google.com/vpc/docs/private-google-access-hybrid)
      #     "199.36.153.8/30": "private-googleapis-com"
      #     # Uncomment to advertise the Private Google Access routes that support VPC Service Controls. (see https://docs.cloud.google.com/vpc/docs/private-google-access-hybrid)
      #     "199.36.153.4/30": "restricted-googleapis-com"
    bgp_session_range: "169.254.128.6/30"
    peer_external_gateway_interface: 0
    shared_secret: "mySecret"
    vpn_gateway_interface: 1
