29 lines
812 B
YAML
29 lines
812 B
YAML
---
|
|
# Vars for every VPS in the fleet. Keep this file plaintext and readable
|
|
# in diffs - actual secret values live in group_vars/all/vault.yml.
|
|
|
|
timezone: "America/Chicago"
|
|
|
|
# The non-root user created/used for all future Ansible runs
|
|
deploy_user: ansible
|
|
deploy_user_shell: /bin/bash
|
|
|
|
# SSH public keys granted access to deploy_user on every host
|
|
deploy_user_ssh_keys:
|
|
- "{{ ssh_key_ansible }}"
|
|
|
|
# Hardening toggles (see roles/security)
|
|
ssh_permit_root_login: "no"
|
|
ssh_password_authentication: "no"
|
|
ssh_port: 25456
|
|
ansible_port: 25456
|
|
|
|
ufw_allowed_tcp_ports:
|
|
- "{{ ssh_port }}"
|
|
|
|
unattended_upgrades_enabled: true
|
|
|
|
# Example of referencing a vault-held secret from a plaintext var.
|
|
# The value itself is defined in group_vars/all/vault.yml as vault_smtp_password.
|
|
smtp_password: "{{ vault_smtp_password }}"
|