TheoCaudan/OT-cyberrange ? reverse-engineered prompt

Build me this OT cyber range so I can deploy a full Purdue style lab on a Linux host with QEMU KVM, libvirt, Ansible, Docker, nftables, and UFW.

I want one playbook that creates the networks, starts the virtual machines, and brings up the main services automatically. The lab should have clear separation between IT, DMZ, OTL3, and OTL2, with the firewall rules set so IT never talks directly to OT, the bastion is the controlled entry point, and Modbus TCP is allowed where needed between the OT layers.

Please make it work with Debian cloud images for Linux VMs and an ISO based Windows Server VM too. Include the Docker based services for bastion and Guacamole, SIEM, SCADA with Ignition, PLC with OpenPLC and a Python worker, plus the Active Directory controller and client. Keep the config easy to edit from vars files, with secrets in Vault. If anything is unclear, check the current docs online before guessing.