118 lines
3.7 KiB
YAML
118 lines
3.7 KiB
YAML
---
|
|
# Use Python 3
|
|
ansible_python_interpreter: /usr/bin/python3
|
|
|
|
# LDAP binding
|
|
# You can hash LDAP passwords with `slappasswd` tool
|
|
ldap_base: 'dc=auro,dc=re'
|
|
ldap_master_ipv4: '10.128.0.21'
|
|
ldap_master_uri: "ldap://re2o-ldap.adm.auro.re"
|
|
ldap_user_tree: "cn=Utilisateurs,{{ ldap_base }}"
|
|
ldap_nslcd_bind_dn: "cn=nslcd,ou=service-users,{{ ldap_base }}"
|
|
ldap_nslcd_passwd: "{{ vault_ldap_nslcd_passwd }}"
|
|
ldap_matrix_bind_dn: "cn=matrix,ou=service-users,{{ ldap_base }}"
|
|
ldap_matrix_password: "{{ vault_ldap_matrix_password }}"
|
|
ldap_replica_password: "{{ vault_ldap_replica_password }}"
|
|
ldap_admin_password: "{{ vault_ldap_admin_password }}"
|
|
ldap_admin_hashed_passwd: "{{ vault_ldap_admin_hashed_passwd }}"
|
|
|
|
# Databases
|
|
postgresql_services_url: 'bdd-ovh.adm.auro.re'
|
|
postgresql_synapse_passwd: "{{ vault_postgresql_synapse_passwd }}"
|
|
postgresql_codimd_passwd: "{{ vault_postgresql_codimd_passwd }}"
|
|
postgresql_etherpad_passwd: "{{ vault_postgresql_etherpad_passwd }}"
|
|
postgresql_kanboard_passwd: "{{ vault_postgresql_kanboard_passwd }}"
|
|
postgresql_grafana_passwd: "{{ vault_postgresql_grafana_passwd }}"
|
|
postgresql_cas_passwd: "{{ vault_postgresql_cas_passwd }}"
|
|
postgresql_drone_passwd: "{{ vault_postgresql_drone_passwd }}"
|
|
postgresql_wikijs_passwd: "{{ vault_postgresql_wikijs_passwd }}"
|
|
postgresql_nextcloud_passwd: "{{ vault_postgresql_nextcloud_passwd }}"
|
|
postgresql_gitea_passwd: "{{ vault_postgresql_gitea_passwd }}"
|
|
|
|
# Scripts will tell users to go there to manage their account
|
|
intranet_url: 'https://re2o.auro.re/'
|
|
|
|
# Users in that group will be able to `sudo`
|
|
sudo_group: 'sudoldap'
|
|
|
|
# SSH keys for root account to use when LDAP is broken
|
|
ssh_pub_keys: "{{ vault_ssh_pub_keys }}"
|
|
|
|
# Monitoring
|
|
monitoring_mail: 'monitoring.aurore@lists.crans.org'
|
|
|
|
# Matrix
|
|
matrix_webhooks_secret: "{{ vault_matrix_webhooks_secret }}"
|
|
matrix_discord_client_id: "559305991494303747"
|
|
matrix_discord_bot_token: "{{ vault_matrix_discord_bot_token }}"
|
|
|
|
###
|
|
# DNS
|
|
###
|
|
|
|
# Dernier octet (en décimal) de l'addresse des serveurs DNS récursifs de chaque
|
|
# résidence.
|
|
dns_host_suffix_main: 253
|
|
dns_host_suffix_backup: 153
|
|
|
|
backup_dns_servers:
|
|
- "80.67.169.12" # French Data Network (FDN) (ns0.fdn.fr)
|
|
|
|
# Finally raised!
|
|
mtu: 1500
|
|
|
|
subnet_ids:
|
|
ap: "14{{ apartment_block_id }}"
|
|
users_wired: "{{ apartment_block_id }}0"
|
|
users_wifi: "{{ apartment_block_id }}1"
|
|
users_banni: "{{ apartment_block_id }}2"
|
|
users_accueil: "{{ apartment_block_id }}3"
|
|
|
|
# Keepalived
|
|
keepalived_password: "{{ vault_keepalived_password[apartment_block] }}"
|
|
|
|
|
|
# Re2o config
|
|
re2o_secret_key: "{{ vault_re2o_secret_key }}"
|
|
re2o_db_password: "{{ vault_re2o_db_password }}"
|
|
re2o_aes_key: "{{ vault_re2o_aes_key }}"
|
|
|
|
# Radius
|
|
radius_secret_aurore: "{{ vault_radius_secrets.aurore }}"
|
|
radius_secret_wifi: "{{ vault_radius_secrets.wifi }}"
|
|
radius_secret_wired: "{{ vault_radius_secrets.wired[apartment_block] }}"
|
|
radius_secret_federez: "{{ vault_radius_secrets.federez }}"
|
|
|
|
radius_pg_replication_password: "{{ vault_re2o_db_user_passwords.replication }}"
|
|
radius_pg_re2o_ro_password: "{{ vault_re2o_db_user_passwords.re2o_ro }}"
|
|
|
|
|
|
# DHCP
|
|
dhcp_failover_enabled: true
|
|
apartment_block_dhcp: "{{ apartment_block }}"
|
|
|
|
|
|
# Careful, this is not byte-aligned, just nibble-aligned (RIPE gave us a /28).
|
|
# However, we ALWAYS keep the trailing 0 to have byte alignment.
|
|
ipv6_base_prefix: "2a09:6840"
|
|
|
|
is_aurore_host: "{{ 'aurore_vm' in group_names }}"
|
|
|
|
# Borgbackup
|
|
borg_keep_daily: 7
|
|
borg_keep_weekly: 4
|
|
borg_keep_monthly: 12
|
|
borg_backup_directories:
|
|
- "/etc/"
|
|
- "/var/"
|
|
borg_backup_exclude:
|
|
- "/var/log/"
|
|
borg_encryption_passphrase: "{{ vault_borg_encryption_passphrase }}"
|
|
|
|
borg_server_host: 10.128.0.4
|
|
|
|
rsyslog_outputs:
|
|
- proto: relp
|
|
address: 10.128.0.241
|
|
port: 20514
|
|
...
|