first push with basic outline

group_vars/all/main.yml

@@ -0,0 +1,28 @@
+---
+# Vars for every VPS in the fleet. Keep this file plaintext and readable
+# in diffs - actual secret values live in group_vars/all/vault.yml.
+
+timezone: "America/Chicago"
+
+# The non-root user created/used for all future Ansible runs
+deploy_user: ansible
+deploy_user_shell: /bin/bash
+
+# SSH public keys granted access to deploy_user on every host
+deploy_user_ssh_keys:
+  - "{{ ssh_key_ansible }}"
+
+# Hardening toggles (see roles/security)
+ssh_permit_root_login: "no"
+ssh_password_authentication: "no"
+ssh_port: 25456
+ansible_port: 25456
+
+ufw_allowed_tcp_ports:
+  - "{{ ssh_port }}"
+
+unattended_upgrades_enabled: true
+
+# Example of referencing a vault-held secret from a plaintext var.
+# The value itself is defined in group_vars/all/vault.yml as vault_smtp_password.
+smtp_password: "{{ vault_smtp_password }}"