41 lines
1.6 KiB
YAML
41 lines
1.6 KiB
YAML
|
# Shared defaults across every inventory (lab/staging/prod). Override
|
||
|
|
# per-environment in `group_vars/<group>.yml` or per-host in
|
||
|
|
# `host_vars/<host>.yml`.
|
||
|
|
---
|
||
|
|
# Owner contact (used in some unattended-upgrades + monitoring agent configs).
|
||
|
|
veza_ops_email: ops@veza.fr
|
||
|
|
|
||
|
|
# v1.0.9 Day 5: SSH hardening surface that the `common` role enforces.
|
||
|
|
# Override these in production via group_vars/veza_prod.yml when the
|
||
|
|
# bastion's specific port / allowed users are decided. Defaults are
|
||
|
|
# safe for lab.
|
||
|
|
ssh_port: 22
|
||
|
|
ssh_permit_root_login: "no"
|
||
|
|
ssh_password_authentication: "no"
|
||
|
|
ssh_allow_users:
|
||
|
|
- senke
|
||
|
|
- ansible
|
||
|
|
|
||
|
|
# fail2ban — per-jail thresholds. The defaults are conservative for
|
||
|
|
# a self-hosted single-machine deployment; production may want
|
||
|
|
# lower findtime / higher bantime once Forgejo + Veza traffic is
|
||
|
|
# baselined.
|
||
|
|
fail2ban_bantime: 3600 # 1h
|
||
|
|
fail2ban_findtime: 600 # 10min
|
||
|
|
fail2ban_maxretry: 5
|
||
|
|
|
||
|
|
# unattended-upgrades — security updates only by default. The role
|
||
|
|
# never enables auto-reboot; ROADMAP_V1.0_LAUNCH.md §5 game day pins
|
||
|
|
# downtime windows to controlled cycles, not OS-driven reboots.
|
||
|
|
unattended_upgrades_origins:
|
||
|
|
- "${distro_id}:${distro_codename}-security"
|
||
|
|
- "${distro_id}ESMApps:${distro_codename}-apps-security"
|
||
|
|
- "${distro_id}ESM:${distro_codename}-infra-security"
|
||
|
|
unattended_upgrades_auto_reboot: false
|
||
|
|
|
||
|
|
# Monitoring agent: prometheus node_exporter is the bare-minimum
|
||
|
|
# host metrics surface (CPU / memory / disk / network). The
|
||
|
|
# observability stack (Tempo + Loki + Grafana) lands W2 in roadmap.
|
||
|
|
monitoring_node_exporter_version: "1.8.2"
|
||
|
|
monitoring_node_exporter_port: 9100
|