---
stack_root: /opt/stacks
traefik_network: traefik
diun_watch_root: "{{ stack_root }}/diun/watch"

# Start with an existing account. After bootstrapping and verifying this one,
# change ansible_user in hosts.yml to the account named here.
admin_user: ops
admin_sudo_group: sudo
admin_user_shell: /bin/bash
admin_user_password_hash: "{{ vault_admin_user_password_hash | default('') }}"

# Keep the current SSH port open through the first hardening run. After a
# successful login on ssh_port, update ansible_port and set this to false.
ssh_port: 2222
ssh_legacy_port: 22
ssh_keep_legacy_port: true
ssh_max_auth_tries: 4
ssh_login_grace_time: 30
ssh_password_authentication: false
ssh_kbd_interactive_authentication: false

ufw_enabled: true
ufw_logging: low
ufw_default_incoming: deny
ufw_default_outgoing: allow
ufw_default_routed: deny
ufw_allowed_rules: []
ufw_remove_rules: []

fail2ban_ssh_maxretry: 5
fail2ban_ssh_findtime: 10m
fail2ban_ssh_bantime: 1h
fail2ban_ignore_ips: []

compose_stacks: []