feat: enhance firewall rules generation with VLAN-specific limits

- Added functionality to limit the number of firewall rules generated per VLAN, allowing for more controlled configurations.
- Updated the `generate_firewall_rules` function to accept an optional parameter for specifying the maximum number of rules per VLAN.
- Enhanced tests to validate the new functionality, ensuring correct rule counts and priority assignments.
- Updated documentation to reflect the new command options for generating firewall rules with VLAN limits.
- All changes have been tested, and functionality is working as expected.

Author: unclesp1d3r

Cargo.lock

@@ -65,7 +65,6 @@ console = "0.16"
 
 # Performance optimization dependencies
 rayon = { version = "1.8", optional = true }     # Data parallelism
-tokio = { version = "1.0", features = ["full"] } # Async runtime
 bumpalo = "3.14"                                 # Arena allocation
 lru = "0.16.0"                                   # Template caching
 rustc-hash = "2.1.1"                             # Faster hashing

Cargo.toml

@@ -217,6 +217,31 @@ cargo run --release -- xml --base-config config.xml --count 500 --output-dir loa
 # Test OPNsense performance with large configs
 ```
 
+### Firewall Rules Generation
+
+```bash
+# Generate configurations with firewall rules (default complexity)
+cargo run --release -- generate --count 25 --format csv --output config.csv --include-firewall-rules
+
+# Generate with specific firewall rule complexity
+cargo run --release -- generate --count 10 --format xml --base-config config.xml --include-firewall-rules --firewall-rule-complexity advanced
+
+# Limit firewall rules per VLAN (useful for testing with smaller rule sets)
+cargo run --release -- generate --count 5 --format csv --output config.csv --include-firewall-rules --firewall-rules-per-vlan 2
+
+# Generate XML with limited firewall rules per VLAN
+cargo run --release -- generate --count 10 --format xml --base-config config.xml --include-firewall-rules --firewall-rules-per-vlan 3 --firewall-rule-complexity intermediate
+```
+
+**Firewall Rules Per VLAN**: The `--firewall-rules-per-vlan` flag allows you to control the number of firewall rules generated per VLAN. This is useful for:
+
+- Testing with smaller, more manageable rule sets
+- Creating focused security scenarios
+- Reducing configuration complexity for specific use cases
+- Performance testing with controlled rule counts
+
+When specified, this flag overrides the default rule count based on complexity level and ensures priorities are reassigned sequentially (1, 2, 3, ...) for each VLAN.
+
 ## Troubleshooting
 
 ### Common Issues

README.md

@@ -177,11 +177,13 @@ just coverage-html
 # CI-friendly coverage (ignores test failures)
 just coverage-ci
 
+Note: CI runs (`just coverage-ci`) will never fail on coverage drops. To enforce an 80% threshold locally, use `just coverage`.
+
 # Terminal coverage report
 just coverage-report
 ```
 
-The project enforces an **80% coverage threshold**. Coverage reports are generated using `cargo-llvm-cov`.
+The project enforces an **80% coverage threshold** locally via `just coverage`. CI runs (`just coverage-ci`) generate reports without threshold enforcement. Coverage reports are generated using `cargo-llvm-cov`.
 
 ### Linting and Formatting
 
@@ -319,7 +321,7 @@ The CI pipeline automatically:
 1. **Validates Formatting**: `just rust-fmt-check`
 2. **Runs Linting**: `just rust-clippy` with strict warnings
 3. **Executes Tests**: `just rust-test` with all features
-4. **Generates Coverage**: `just coverage-ci` with 80% threshold
+4. **Generates Coverage**: `just coverage-ci` generates lcov report (no threshold enforcement)
 5. **Respects Environment**: Adapts output based on `TERM` variable
 
 ## Test Data and Fixtures

TESTING.md

@@ -123,6 +123,7 @@ coverage:
 coverage-ci:
     @echo "🔍 Running coverage for CI (generating lcov report)..."
     cargo llvm-cov --all-features --workspace --lcov --output-path lcov.info --ignore-run-fail
+    @echo "ℹ️ This CI step does not enforce coverage thresholds. Run \`just coverage\` locally to gate on 80%."
     @echo "✅ Coverage report generated!"
 
 # Run coverage report in HTML format for local viewing

justfile

@@ -180,8 +180,14 @@ fn execute_csv_generation(args: &GenerateArgs) -> Result<()> {
 
         // Generate firewall rules
         let firewall_pb = create_progress_bar(configs.len() as u64, "Generating firewall rules...");
-        let firewall_rules =
-            generate_firewall_rules(&configs, complexity, args.seed, Some(&firewall_pb))?;
+        let firewall_rules = generate_firewall_rules(
+            &configs,
+            complexity,
+            args.seed,
+            Some(&firewall_pb),
+            args.firewall_rules_per_vlan,
+        )?;
+
         firewall_pb.finish_with_message(format!(
             "✅ Generated {} firewall rules",
             firewall_rules.len()
@@ -250,7 +256,14 @@ fn execute_xml_generation(args: &GenerateArgs) -> Result<()> {
 
         // Generate firewall rules
         let firewall_pb = create_progress_bar(configs.len() as u64, "Generating firewall rules...");
-        let rules = generate_firewall_rules(&configs, complexity, args.seed, Some(&firewall_pb))?;
+        let rules = generate_firewall_rules(
+            &configs,
+            complexity,
+            args.seed,
+            Some(&firewall_pb),
+            args.firewall_rules_per_vlan,
+        )?;
+
         firewall_pb.finish_with_message(format!("✅ Generated {} firewall rules", rules.len()));
 
         // Write firewall rules to CSV for reference