lab "demo" {
  gui = true                       // lab-wide default: show each guest's screen
  vm "box" {
    template = "x86_64/linux-modern"
    memory   = 2GiB
    nic { nat = true }
  }
}

segment "corp" {
  subnet = "10.50.0.0/24"          // omit to auto-allocate a /24 from the host pool
  nat    = true                    // internet egress for this segment
  record { name = "dc01" ip = "10.50.0.10" }
}

dns { server = "10.50.0.10" }      // hand out a DC as the resolver via DHCP
dns { enabled = false }            // …or suppress DNS on the segment entirely

connect { host = "helios:9999" }   // bridge this segment to a peer supervisor (PSK)

route { dest = "10.60.0.0/24" via = "10.50.0.254" }   // pushed via DHCP option 121

record { name = "srv" ip = "10.50.0.5" }     // wildcards OK: name = "*.internal"

forward { host_port = 13389 to = "dc01:3389" proto = "tcp" }

block { cidr = "192.0.2.0/24" proto = "tcp" port = 443 }

redirect { from = "10.50.0.254:53" to = "10.50.0.10:53" proto = "udp" }

sinkhole { pattern = "*.telemetry.com" mode = "nxdomain" }   // or mode = "zero"

vm "dc01" {
  template = "x86_64/windows-2025"
  cpus     = 4
  memory   = 8GiB
  nic   { segment = "corp" ip = "10.50.0.10" }
  share { host = "./src" guest = "D:\\src" }
}

gpu { mode = "passthrough" address = "0000:01:00.0" }   // or mode = "virgl" | "vulkan"

nic { segment = "corp" ip = "10.50.0.10" mac = "52:54:00:aa:bb:cc" }
nic { nat = true }                       // per-lab built-in NAT segment shorthand
nic { segment = "dmz" isolated = true }  // port isolation

disk "data"      { size = 10GiB }         // extra blank disk
disk "formatted" { from = "./payload/" }  // folder copied onto a fresh FAT filesystem

share { host = "./src"  guest = "/mnt/src" }         // transport auto: virtiofs, else SMB
share { host = "~/data" guest = "D:\\data" readonly = true }
share { host = "./old"  guest = "X:" smb1 = true }   // legacy dialect for XP/2003

media { kind = "iso"    from = "./unattend/" label = "CIDATA" }
media { kind = "floppy" from = "./drivers/"  label = "DRV" }

web "admin" { port = 8080  path = "/manage" }   // proxied into the web console

auth { method = :basic  username = "admin" password = "s3cret" }
auth { method = :bearer token = "eyJ…" }
auth { method = :ntlm   username = "Administrator" password = "…" domain = "CORP" }
auth { method = :form   username = "admin" password = "…"
       login_path = "/login" login_body = "user={user}&pass={pass}" }

// Machine-level identity (PRD §19.2). The label is what an SSH username
// selects; the secret is written plainly, because the lab's own provisioning
// created the account and already carries the same string.
// On a Windows-family profile every login needs a `password`. `elevated`
// (default true) selects the linked token, so one account can be declared
// twice at two elevations — the labels are what tell them apart, and they
// must be unique on a machine.
login "dev"      { user = "PROBE\\dev" password = "vmlab123!" default = true }
login "dev-user" { user = "PROBE\\dev" password = "vmlab123!" elevated = false }
// On a Linux-family profile `elevated` is a validation error, and the secret
// is only needed where something authenticates against it.
login "ops" { user = "ops" }

// Declared inside the vm/container it configures; runs once that machine is
// ready, at this position among its steps.
provision "scripts/setup.ws" { }

// Declared inside the vm/container it converges.
playbook "playbooks/domain" { play = "dc" }
playbook "playbooks/domain" {
  play = "member"
  var "domain"      { value = "corp.example.com" }
  var "member_name" { value = "APP01" }   // --var, this machine only
}

var "domain"  { value = "corp.example.com" }  // --var domain=corp.example.com
var "retries" { value = "3" }                 // config-weave reads this as an int
var "tag"     { value = "\"3\"" }               // quoted: forced to a string

container "web" {
  image      = "nginx:1.27"              // docker.io shorthand; @sha256:… pins
  mode       = :workload                  // :workload (default) | :idle
  profile    = "container"               // micro-VM hardware floor (§5.3)
  memory     = 512MiB                    // overrides the profile; cpus likewise
  depends_on = ["db"]                    // VM or container names — one namespace
  nic    { segment = "corp" ip = "10.50.0.20" }
  env    { name = "MODE" value = "prod" }
  volume { name = "data" target = "/var/lib/data" }
  port   { host = 18080 container = 80 }
  healthcheck { command = ["curl", "-fsS", "http://localhost/"] interval = 5s }
}

nic { segment = "corp" ip = "10.50.0.10" mac = "52:54:00:aa:bb:cc" }
nic { nat = true }                       // per-lab built-in NAT segment shorthand
nic { segment = "dmz" isolated = true }  // port isolation

env { name = "PGUSER" value = "app" }

volume { name = "data"  target = "/var/lib/data" }               // named, lab-scoped
volume { host = "./www" target = "/srv/www" read_only = true }   // host bind

port { host = 18080 container = 80 proto = "tcp" }   // sugar for a segment forward

healthcheck {
  command      = ["curl", "-fsS", "http://localhost/"]   // exit 0 = healthy
  interval     = 10s
  timeout      = 5s
  retries      = 3
  start_period = 10s
}

// Machine-level identity (PRD §19.2). The label is what an SSH username
// selects; the secret is written plainly, because the lab's own provisioning
// created the account and already carries the same string.
// On a Windows-family profile every login needs a `password`. `elevated`
// (default true) selects the linked token, so one account can be declared
// twice at two elevations — the labels are what tell them apart, and they
// must be unique on a machine.
login "dev"      { user = "PROBE\\dev" password = "vmlab123!" default = true }
login "dev-user" { user = "PROBE\\dev" password = "vmlab123!" elevated = false }
// On a Linux-family profile `elevated` is a validation error, and the secret
// is only needed where something authenticates against it.
login "ops" { user = "ops" }

web "admin" { port = 8080  path = "/manage" }   // proxied into the web console

auth { method = :basic  username = "admin" password = "s3cret" }
auth { method = :bearer token = "eyJ…" }
auth { method = :ntlm   username = "Administrator" password = "…" domain = "CORP" }
auth { method = :form   username = "admin" password = "…"
       login_path = "/login" login_body = "user={user}&pass={pass}" }

// Declared inside the vm/container it configures; runs once that machine is
// ready, at this position among its steps.
provision "scripts/setup.ws" { }

// Declared inside the vm/container it converges.
playbook "playbooks/domain" { play = "dc" }
playbook "playbooks/domain" {
  play = "member"
  var "domain"      { value = "corp.example.com" }
  var "member_name" { value = "APP01" }   // --var, this machine only
}

var "domain"  { value = "corp.example.com" }  // --var domain=corp.example.com
var "retries" { value = "3" }                 // config-weave reads this as an int
var "tag"     { value = "\"3\"" }               // quoted: forced to a string

on "vm.crashed"    { run = "scripts/collect-dumps.ws" }
on "host.disk_low" { run = "scripts/alert.ws" }

record { name = "srv" ip = "10.50.0.5" }     // wildcards OK: name = "*.internal"

sinkhole { pattern = "*.telemetry.com" mode = "nxdomain" }   // or mode = "zero"

template "linux-modern" {
  arch    = "x86_64"
  version = "1.0"
  profile = "linux-modern"
  disk    = 20GiB                  // working disk size for the build
  source "iso" { url = "https://releases.ubuntu.com/.../x.iso" sha256 = "abc123…" }
  provision "scripts/install.ws" { }
}

source "iso"      { path = "./isos/win11.iso" }           // local installer ISO
source "iso"      { url = "https://…" sha256 = "…" }      // downloaded + verified
source "qcow2"    { path = "./base.qcow2" }               // existing disk as base
source "template" { from = "x86_64/linux-modern@1.0" }    // layered build
source "scratch"  { }                                     // blank disk

media { kind = "iso"    from = "./unattend/" label = "CIDATA" }
media { kind = "floppy" from = "./drivers/"  label = "DRV" }

// Declared inside the vm/container it configures; runs once that machine is
// ready, at this position among its steps.
provision "scripts/setup.ws" { }

// Declared inside the vm/container it converges.
playbook "playbooks/domain" { play = "dc" }
playbook "playbooks/domain" {
  play = "member"
  var "domain"      { value = "corp.example.com" }
  var "member_name" { value = "APP01" }   // --var, this machine only
}

var "domain"  { value = "corp.example.com" }  // --var domain=corp.example.com
var "retries" { value = "3" }                 // config-weave reads this as an int
var "tag"     { value = "\"3\"" }               // quoted: forced to a string

nic { segment = "corp" ip = "10.50.0.10" mac = "52:54:00:aa:bb:cc" }
nic { nat = true }                       // per-lab built-in NAT segment shorthand
nic { segment = "dmz" isolated = true }  // port isolation

disk "data"      { size = 10GiB }         // extra blank disk
disk "formatted" { from = "./payload/" }  // folder copied onto a fresh FAT filesystem

host {
  subnet_pool      = "10.213.0.0/16"   // segment auto-allocation pool (default shown)
  dns_suffix       = "vmlab.internal"
  dns_upstream     = "1.1.1.1"
  disk_low_percent = 10
  viewer           = "vncviewer {}"    // {} = target
  oci_chunk_size   = 512MiB
}