a bit o' spruce, from http://play.spruce.cf

spruce.json

{"flavor":"1.15.3","prune":["meta"],"env":["HOME=/home/user"],"cherry_pick":[],"yaml":[{"filename":"file1.yml","contents":"director_uuid: (( grab secrets.bosh.bosh_ops_uuid )) \nname: cf-rabbit\n\nreleases:\n- name: cf-rabbitmq\n  version: latest\n\njobs:\n- name: rmq\n  templates:\n  - {name: rabbitmq-server, release: cf-rabbitmq}\n  instances: 1\n  resource_pool: services-small\n  persistent_disk: 20000\n  networks:\n  - name: services1\n    static_ips:\n    - 192.168.30.206\n\n- name: rmq-broker\n  templates:\n  - {name: rabbitmq-broker, release: cf-rabbitmq}\n  instances: 1\n  resource_pool: services-small\n  networks:\n  - name: services1\n    static_ips:\n    - 192.168.30.207\n\n- name: haproxy\n  templates:\n  - {name: rabbitmq-haproxy, release: cf-rabbitmq}\n  instances: 1\n  resource_pool: services-small\n  networks:\n  - name: services1\n    static_ips:\n    - 192.168.30.208\n\n- name: broker-registrar\n  templates:\n  - {name: broker-registrar, release: cf-rabbitmq}\n  instances: 1\n  lifecycle: errand\n  networks:\n  - name: services1\n  properties:\n    broker:\n      protocol: http\n      host: 192.168.30.207\n      port: 4567\n      name: p-rabbitmq\n      username: \"p1-rabbit\"\n      password: (( grab secrets.cloudfoundry.service_brokers.p-rabbitmq.password ))\n  resource_pool: services-small\n\n- name: broker-deregistrar\n  templates:\n  - {name: broker-deregistrar, release: cf-rabbitmq}\n  instances: 1\n  lifecycle: errand\n  networks:\n  - name: services1\n  properties:\n    broker:\n      protocol: http\n      host: 192.168.30.207\n      port: 4567\n      name: p-rabbitmq\n      username: \"p1-rabbit\"\n      password: (( grab secrets.cloudfoundry.service_brokers.p-rabbitmq.password ))\n  resource_pool: services-small\n\nproperties:\n  # for broker and route registrars\n  cf:\n    domain: (( grab secrets.cloudfoundry.system_domain ))\n    admin_password: (( grab secrets.cloudfoundry.admin_password ))\n    admin_username: admin\n    api_url: (( concat \"https://api.\" secrets.cloudfoundry.system_domain ))\n    nats:\n      host: (( grab secrets.cloudfoundry.nats_host ))\n      port: 4222\n      password: (( grab secrets.cloudfoundry.nats_password ))\n      username: nats\n  route-registrar:\n    target_ip: 192.168.30.208\n  rabbitmq-server:\n    plugins:\n    - rabbitmq_management\n    - rabbitmq_mqtt\n    - rabbitmq_stomp\n    administrators:\n      broker:\n        username: broker\n        password: battIcigJu\n    static_ips:\n    - 192.168.30.206\n#    ssl:\n  rabbitmq-haproxy:\n    stats:\n      username: haproxy-stat-user\n      password: kocsefisdu\n    ports:\n    - 5672\n    - 5671\n    - 1883\n    - 8883\n    - 61613\n    - 61614\n    - 15672\n    - 15674\n    server_ips:\n    - 192.168.30.206\n\n  rabbitmq-broker:\n    ip: 192.168.30.207\n    cc_endpoint: (( concat \"https://api.\" secrets.cloudfoundry.system_domain )) #https://nd-cfapi.itn.ftgroup\n    uaa_client:\n      client_id: cf\n      username: admin\n      password: (( grab secrets.cloudfoundry.admin_password ))\n    service:\n      username: \"p1-rabbit\"\n      password: (( grab secrets.cloudfoundry.service_brokers.p-rabbitmq.password ))\n      url: http://192.168.30.207:4567\n    logging:\n      level: debug\n      print_stack_traces: false\n\n    rabbitmq:\n      management_ip: 192.168.30.208\n      management_domain: (( concat \"pivotal-rabbitmq.\" secrets.cloudfoundry.system_domain )) #pivotal-rabbitmq.nd-cfapi.itn.ftgroup\n#      ssl: |\n#        -----BEGIN CERTIFICATE-----\n#        ****** KEY GOES HERE **********\n#        -----END CERTIFICATE-----\n      hosts:\n        - 192.168.30.208\n      administrator:\n        username: broker\n        password: (( grab secrets.rabbit.broker.password ))\n\nnetworks:\n- name: services1\n  type: manual\n  subnets:\n  - range: 192.168.30.0/24\n    gateway: 192.168.30.254\n    dns: [192.168.116.155,192.168.116.165]    \n    #reserved is the ones that bosh should not be using\n    reserved:\n    - 192.168.30.1 - 192.168.30.199\n    - 192.168.30.211 - 192.168.30.253    \n    cloud_properties:\n      net_id: (( grab meta.net_ids.service ))  # \u003c-- from openstack  \n      security_groups: [default]\n    # Static IP pool that can be consumed by jobs when explictly assigned to one.\n    static:\n    - 192.168.30.205 - 192.168.30.210\n    \n- name: compilation-network\n  type: dynamic\n  cloud_properties:\n    net_id: (( grab meta.net_ids.compilation ))  # \u003c-- from openstack tf_net_bosh2\n    security_groups: [default]\n  \n\nresource_pools:\n- cloud_properties:\n    instance_type: n2.cw.standard-1\n  name: services-small\n  network: services1\n  stemcell:\n    name: bosh-openstack-kvm-ubuntu-trusty-go_agent\n    version: latest\n\n\nupdate:\n  canaries: 1\n  canary_watch_time: 30000-180000\n  update_watch_time: 30000-180000\n  max_in_flight: 4\n\ncompilation:\n  cloud_properties:\n    instance_type: n2.cw.standard-1\n  network: compilation-network\n  reuse_compilation_vms: true\n  workers: 4\n\n"}],"skip_eval":false,"fallback_append":false,"go_patch":false,"debug":false,"trace":false}