37 lines
1004 B
Plaintext
37 lines
1004 B
Plaintext
---
|
|
stack_root: /opt/stacks
|
|
traefik_network: traefik
|
|
diun_watch_root: "{{ stack_root }}/diun/watch"
|
|
|
|
# Start with an existing account. After bootstrapping and verifying this one,
|
|
# change ansible_user in hosts.yml to the account named here.
|
|
admin_user: ops
|
|
admin_sudo_group: sudo
|
|
admin_user_shell: /bin/bash
|
|
admin_user_password_hash: "{{ vault_admin_user_password_hash | default('') }}"
|
|
|
|
# Keep the current SSH port open through the first hardening run. After a
|
|
# successful login on ssh_port, update ansible_port and set this to false.
|
|
ssh_port: 2222
|
|
ssh_legacy_port: 22
|
|
ssh_keep_legacy_port: true
|
|
ssh_max_auth_tries: 4
|
|
ssh_login_grace_time: 30
|
|
ssh_password_authentication: false
|
|
ssh_kbd_interactive_authentication: false
|
|
|
|
ufw_enabled: true
|
|
ufw_logging: low
|
|
ufw_default_incoming: deny
|
|
ufw_default_outgoing: allow
|
|
ufw_default_routed: deny
|
|
ufw_allowed_rules: []
|
|
ufw_remove_rules: []
|
|
|
|
fail2ban_ssh_maxretry: 5
|
|
fail2ban_ssh_findtime: 10m
|
|
fail2ban_ssh_bantime: 1h
|
|
fail2ban_ignore_ips: []
|
|
|
|
compose_stacks: []
|