{% load i18n %}{% comment %}Router-Konfiguration (CLAUDE.md 4.13): einmalige Anzeige. Erwartet gw, config, qr_svg,
download_href, filename. Anleitung: docs/router-rutos.md{% endcomment %}
<div class="card">
  <p>{% blocktranslate trimmed %}<strong>Important:</strong> This configuration contains the secret key of the router and is
  only shown now. The portal does not store it. The previous configuration is no longer valid from now on.{% endblocktranslate %}</p>
  <p><a class="btn" href="{{ download_href }}" download="{{ filename }}">{% blocktranslate trimmed with name=filename %}Download configuration file ({{ name }}){% endblocktranslate %}</a></p>
  <details><summary>{% translate "Show content and QR code" %}</summary>
    <pre>{{ config }}</pre>
    <div class="qr">{{ qr_svg }}</div>
  </details>
</div>
<div class="card">
  <h2>{% translate "Enter in the router (e.g. Teltonika RUT241)" %}</h2>
  <p class="muted">{% translate "Instructions with details: docs/router-rutos.md" %}</p>
  <ol>
    <li>{% blocktranslate trimmed %}In the router under <em>Services → VPN → WireGuard</em> create an instance and import the file.
      Without an import function transfer the values by hand, switching on <em>Route allowed IPs</em>.{% endblocktranslate %}</li>
    <li>{% translate "Activate the instance. After a few seconds the gateway shows “Tunnel up”." %}</li>
    {% if gw.uplink_mode == "client" %}
    <li>{% blocktranslate trimmed with address=gw.uplink_address fqdn=gw.fqdn port=gw.phone_endpoint_port %}Through the tunnel the server only comes as <code>10.78.0.1</code>. It passes on to
      <code>{{ address }}</code>: HTTPS for <code>{{ fqdn }}</code> (TCP 443, with
      PROXY protocol header) and UDP port {{ port }} of the server as UDP 51820. What the router
      does with it is up to you; Rivet functions (phones, interface, certificate) do not exist without a
      Rivet gateway.{% endblocktranslate %}</li>
    {% else %}
    <li>{% blocktranslate trimmed %}Under <em>Network → Firewall → Port forwards</em> forward from the WireGuard zone to the Rivet gateway,
      only these three, without rewriting the source address:{% endblocktranslate %}
      <ul>
        <li>{% translate "TCP 443 → Rivet gateway:443" %}</li>
        <li>{% translate "TCP 80 → Rivet gateway:80" %}</li>
        <li>{% translate "UDP 51820 → Rivet gateway:51820" %}</li>
      </ul></li>
    <li>{% blocktranslate trimmed %}Allow nothing else from the WireGuard zone into the farm network. The router decides whether the server
      gets into the farm network.{% endblocktranslate %}</li>
    <li>{% blocktranslate trimmed with fqdn=gw.fqdn %}Check: <a href="https://{{ fqdn }}">https://{{ fqdn }}</a> shows the login page of the
      Rivet gateway without a certificate warning.{% endblocktranslate %}</li>
    {% endif %}
  </ol>
</div>