ansible/group_vars/all/vars.yml

---
# Use Python 3
ansible_python_interpreter: /usr/bin/python3

# LDAP binding
# You can hash LDAP passwords with `slappasswd` tool
ldap_base: 'dc=auro,dc=re'
ldap_master_ipv4: '10.128.0.21'
ldap_master_uri: "ldap://re2o-ldap.adm.auro.re"
ldap_user_tree: "cn=Utilisateurs,{{ ldap_base }}"
ldap_nslcd_bind_dn: "cn=nslcd,ou=service-users,{{ ldap_base }}"
ldap_nslcd_passwd: "{{ vault_ldap_nslcd_passwd }}"
ldap_matrix_bind_dn: "cn=matrix,ou=service-users,{{ ldap_base }}"
ldap_matrix_password: "{{ vault_ldap_matrix_password }}"
ldap_replica_password: "{{ vault_ldap_replica_password }}"
ldap_admin_password: "{{ vault_ldap_admin_password }}"
ldap_admin_hashed_passwd: "{{ vault_ldap_admin_hashed_passwd }}"

# Databases
postgresql_services_url: 'services-bdd.adm.auro.re'
postgresql_synapse_passwd: "{{ vault_postgresql_synapse_passwd }}"
postgresql_codimd_passwd: "{{ vault_postgresql_codimd_passwd }}"

# Scripts will tell users to go there to manage their account
intranet_url: 'https://re2o.auro.re/'

# Users in that group will be able to `sudo`
sudo_group: 'sudoldap'

# SSH keys for root account to use when LDAP is broken
ssh_pub_keys: "{{ vault_ssh_pub_keys }}"

# Monitoring
monitoring_mail: 'monitoring.aurore@lists.crans.org'

# Matrix
matrix_webhooks_secret: "{{ vault_matrix_webhooks_secret }}"
matrix_discord_client_id: "559305991494303747"
matrix_discord_bot_token: "{{ vault_matrix_discord_bot_token }}"

###
# DNS
###

# Dernier octet (en décimal) de l'addresse des serveurs DNS récursifs de chaque
# résidence.
dns_host_suffix_main: 253
dns_host_suffix_backup: 153

backup_dns_servers:
  - "80.67.169.12"  # French Data Network (FDN) (ns0.fdn.fr)

# Finally raised!
mtu: 1500

subnet_ids:
  ap: "14{{ apartment_block_id }}"
  users_wired: "{{ apartment_block_id }}0"
  users_wifi: "{{ apartment_block_id }}1"
  users_banni: "{{ apartment_block_id }}2"
  users_accueil: "{{ apartment_block_id }}3"

# Keepalived
keepalived_password: "{{ vault_keepalived_password[apartment_block] }}"


# Re2o config
re2o_secret_key: "{{ vault_re2o_secret_key }}"
re2o_db_password: "{{ vault_re2o_db_password }}"
re2o_aes_key: "{{ vault_re2o_aes_key }}"

# Radius
radius_secret_aurore: "{{ vault_radius_secrets.aurore }}"
radius_secret_wifi: "{{ vault_radius_secrets.wifi }}"
radius_secret_wired: "{{ vault_radius_secrets.wired[apartment_block] }}"
radius_secret_federez: "{{ vault_radius_secrets.federez }}"

radius_pg_replication_password: "{{ vault_re2o_db_user_passwords.replication }}"
radius_pg_re2o_ro_password: "{{ vault_re2o_db_user_passwords.re2o_ro }}"


# DHCP
dhcp_failover_enabled: true
apartment_block_dhcp: "{{ apartment_block }}"


# Careful, this is not byte-aligned, just nibble-aligned (RIPE gave us a /28).
# However, we ALWAYS keep the trailing 0 to have byte alignment.
ipv6_base_prefix: "2a09:6840"

is_aurore_host: "{{ 'aurore_vm' in group_names }}"

nftables_interco_v4:
  - 10.129.0.0/16
  - 192.168.0.0/31
  - 192.168.0.2/31

nftables_interco_v6:
  - 2a09:6840:129::0/48

nftables_adm_v4:
  - 10.133.0.0/16

nftables_adm_v6:
  - 2a09:6840:133::0/48

nftables_bastions_v4:
  - 10.133.0.250

nftables_bastions_v6:
  - 2a09:6840:133::250

nftables_svc_v4:
  - 10.128.0.0/16
  - 10.132.0.0/16

nftables_svc_v6:
  - 2a09:6840:128::0/48
  - 2a09:6840:132::0/48

nftables_members_v4:
  - 10.10.0.0/16
  - 10.11.0.0/16
  - 10.20.0.0/16
  - 10.21.0.0/16
  - 10.30.0.0/16
  - 10.31.0.0/16
  - 10.40.0.0/16
  - 10.41.0.0/16
  - 10.50.0.0/16
  - 10.51.0.0/16

nftables_members_v6:
  - 2a09:6840:10::0/48
  - 2a09:6840:11::0/48
  - 2a09:6840:12::0/48
  - 2a09:6840:20::0/48
  - 2a09:6840:21::0/48
  - 2a09:6840:22::0/48
  - 2a09:6840:30::0/48
  - 2a09:6840:31::0/48
  - 2a09:6840:32::0/48
  - 2a09:6840:40::0/48
  - 2a09:6840:41::0/48
  - 2a09:6840:42::0/48
  - 2a09:6840:50::0/48
  - 2a09:6840:51::0/48
  - 2a09:6840:52::0/48

nftables_signup_v4:
  - 10.13.0.0/16
  - 10.23.0.0/16
  - 10.33.0.0/16
  - 10.43.0.0/16
  - 10.53.0.0/16

nftables_signup_v6:
  - 2a09:6840:13::0/48
  - 2a09:6840:23::0/48
  - 2a09:6840:33::0/48
  - 2a09:6840:43::0/48
  - 2a09:6840:53::0/48

# Afone network
nftables_signup_triggers_v4:
  - 217.112.64.0/20
  - 46.255.48.0/21
  - 77.74.240.0/21
  - 93.191.184.0/21

# Afone network
nftables_signup_triggers_v6:
  - 2a02:20f8::/32
...