---
### wird in vielen Rollen verwendet
ansible_facts_parallel: true
ssh_public_key_mg: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKL8opSQ0rWVw9uCfbuiqmXq188OP4xh66MBTO3zV5jo heimserver_mg_v3
my_mail: michael.grote@posteo.de
file_header: |
  #----------------------------------------------------------------#
  #              This file is managed with ansible!                #
  #----------------------------------------------------------------#
# für Zugriff auf nicht öffentliche git.mgrote.net-Repos
ansible_forgejo_user: svc_ansible
ansible_forgejo_user_pass: "{{ lookup('viczem.keepass.keepass', 'user_setup_forgejo_user_pass', 'password') }}" # User ist dem Repo als "Collaborator" + "RO" hinzugefügt worden

### patrickjahns.promtail
promtail_version: "3.0.0" # TODO renovate
promtail_loki_server_url: "http://docker10.mgrote.net:3100" # TODO passt das für blocky?
promtail_user_additional_groups: root
promtail_config_scrape_configs:
  - job_name: system
    static_configs:
    - targets:
        - localhost
      labels:
        host: "{{ ansible_fqdn }}"
        job: varlogs
        __path__: /var/log/**/**
# TODO add docker und lokale logs wenn sie cniht in /var/log liegen: https://ruanbekker.medium.com/logging-with-docker-promtail-and-grafana-loki-d920fd790ca8

### mgrote_user_setup
dotfiles:
  - user: mg
    home: /home/mg
  - user: root
    home: /root
dotfiles_repo_url: https://git.mgrote.net/mg/dotfiles
dotfiles_vim_vundle_repo_url: "https://{{ ansible_forgejo_user | urlencode }}:{{ ansible_forgejo_user_pass | urlencode }}@git.mgrote.net/mirrors/Vundle.vim.git"
### mgrote_netplan
netplan_configure: true

### mgrote_user
users:
  - username: mg
    password: "{{ lookup('viczem.keepass.keepass', 'mg_linux_password_hash', 'password') }}"
    update_password: always
    groups: ssh, sudo
    state: present
    public_ssh_key: "{{ ssh_public_key_mg }}"
    allow_sudo: true
    allow_passwordless_sudo: true
  - username: ansible-user
    password: "{{ lookup('viczem.keepass.keepass', 'ansible_user_linux_password_hash', 'password') }}"
    update_password: always
    groups: ssh, sudo
    state: present
    public_ssh_key: ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJcBwOjanQV6sFWaTetqpl20SVe3aRzGjKbsp7hKkDCE mg@irantu
    allow_sudo: true
    allow_passwordless_sudo: true

### hifis_unattended_upgrades
unattended_mail: "{{ my_mail }}"
unattended_mail_only_on_error: true
unattended_syslog_enable: true
unattended_package_blacklist: [libzfs4linux, libzpool5linux, zfs-initramfs, zfs-zed, zfsutils-linux]
unattended_origins_patterns:
  - 'origin=Ubuntu,archive=${distro_codename}-security'
  - 'o=Ubuntu,a=${distro_codename}-updates'

### mgrote_ntp_chrony_client
ntp_chrony_timezone: "Europe/Berlin" # Zeitzone in der sich der Computer befindet
ntp_chrony_driftfile_directory: "/var/lib/chrony" # Ordner für das driftfile
ntp_chrony_servers: # welche Server sollen befragt werden
  - address: 192.168.2.1
    options: iburst #optionaler parameter
ntp_chrony_user: _chrony # Nutzer + Gruppe für den Dienst
ntp_chrony_group: _chrony # Nutzer + Gruppe für den Dienst
ntp_chrony_logging: false

### mgrote_postfix
postfix_smtp_server: docker10.mgrote.net
postfix_smtp_server_port: 1025

### mgrote_fail2ban
f2b_bantime: 300
f2b_findtime: 300
f2b_maxretry: 5
f2b_destemail: "{{ my_mail }}"
f2b_sender: info@mgrote.net

### oefenweb.ufw
ufw_rules:
  - rule: allow
    to_port: 22
    protocol: tcp
    comment: 'ssh'
    from_ip: 0.0.0.0/0
  - rule: allow
    to_port: 4949
    protocol: tcp
    comment: 'munin'
    from_ip: 192.168.2.0/24
  - rule: allow
    to_port: 9080
    protocol: tcp
    comment: 'promtail'
    from_ip: 192.168.2.0/24
ufw_default_incoming_policy: deny
ufw_default_outgoing_policy: allow

### mgrote_restic
restic_exclude: |
      ._*
      desktop.ini
      .Trash-*
      **/**cache***/**
      **/**Cache***/**
      **/**AppData***/**
restic_folders_to_backup: "/usr/local /etc /root /home"
restic_repository: "//fileserver3.mgrote.net/restic"
restic_fail_mail: michael.grote@posteo.de
restic_repository_password: "{{ lookup('viczem.keepass.keepass', 'restic_repository_password', 'password') }}"
restic_mount_password: "{{ lookup('viczem.keepass.keepass', 'fileserver_smb_user_restic', 'password') }}" #gitleaks:allow
restic_mount_user: restic
restic_schedule: "*-*-* 4:00:00"

### mgrote_apt_manage_packages
apt_packages_common:
  - locales
  - python3
  - build-essential
  - htop
  - git
  - dnsutils
  - mc
  - cifs-utils
  - haveged #https://www.linux-magazin.de/ausgaben/2011/09/einfuehrung2/
  - ca-certificates
  - netdiscover
  - tree
  - curl
  - whois
  - logrotate
  - ncdu
  - net-tools
  - apt-transport-https
  - moreutils
  - acl
  - vim
  - rsync
  - at
  - ripgrep
  - iotop
  - pwgen
  - keychain
  - bc
  - jq
apt_packages_physical:
  - s-tui
  - smartmontools
  - lm-sensors
  - ethtool
  - fwupd
apt_packages_vm:
  - qemu-guest-agent
  - open-vm-tools
apt_packages_absent:
  - nano
  - snapd
  - ubuntu-advantage-tools
  - neofetch
  - graphviz
  - ubuntu-pro-client

### mgrote_zfs_sanoid
sanoid_templates:
  - name: '31tage'
    keep_hourly: '24'                        # Aufheben (Stunde)
    keep_daily: '31'                         # Aufheben (Tage)
    keep_monthly: '3'                        # Aufheben (Monate)
    keep_yearly: '0'                         # Aufheben (Jahre)
    frequently: '16'                         # Aufheben (Minuten)
    frequent_period: '15'                    # Intervall (alle 5 Minuten)
    autosnap: 'yes'                          # Automatisches erstellen von Snapshots
    autoprune: 'yes'
  - name: '14tage'
    keep_hourly: '24'
    keep_daily: '14'
    keep_monthly: '0'
    keep_yearly: '0'
    frequently: '16'
    frequent_period: '15'
    autosnap: 'yes'
    autoprune: 'yes'
  - name: '3tage'
    keep_hourly: '24'
    keep_daily: '7'
    keep_monthly: '0'
    keep_yearly: '0'
    frequently: '16'
    frequent_period: '15'
    autosnap: 'yes'
    autoprune: 'yes'
  - name: '3monate'
    keep_hourly: '24'
    keep_daily: '7'
    keep_monthly: '3'
    keep_yearly: '0'
    frequently: '16'
    frequent_period: '15'
    autosnap: 'yes'
    autoprune: 'yes'
  - name: 'pve3tage'
    keep_hourly: '72'
    keep_daily: '5'
    keep_monthly: '0'
    keep_yearly: '0'
    frequently: '16'
    frequent_period: '15'
    autosnap: 'yes'
    autoprune: 'yes'

### mgrote_zfs_sanoid
sanoid_deb_url: http://docker10.mgrote.net:3344/sanoid_v2.2.0.deb

### mgrote_munin_node
munin_node_plugins_repo_user: "{{ ansible_forgejo_user }}"
munin_node_plugins_repo_user_pass: "{{ ansible_forgejo_user_pass }}"
munin_node_bind_host: "0.0.0.0"
munin_node_bind_port: "4949"
munin_node_allowed_cidrs: [192.168.2.0/24]
munin_node_disabled_plugins:
  - meminfo # zu hohe last
  - hddtemp2 # ersetzt durch hddtemp_smartctl
  - ntp # verursacht zu viele dns ptr request
  - hddtempd # ersetzt durch hddtemp_smartctl
  - squid_cache # proxmox
  - squid_objectsize # proxmox
  - squid_requests # proxmox
  - squid_traffic # proxmox
  - timesync
  - docker_volumesize2
  - docker_multi

munin_node_plugins:
  - name: chrony
    src: https://git.mgrote.net/mirrors/munin-contrib/raw/branch/master/plugins/chrony/chrony
  - name: systemd_status
    src: https://git.mgrote.net/mirrors/munin-contrib/raw/branch/master/plugins/systemd/systemd_status
  - name: systemd_mem
    src: https://git.mgrote.net/mirrors/munin-contrib/raw/branch/master/plugins/systemd/systemd_mem
    config: |
      [systemd_mem]
      env.all_services true
  - name: lvm_
    src: https://git.mgrote.net/mirrors/munin-contrib/raw/branch/master/plugins/disk/lvm_
    config: |
      [lvm_*]
      user root
  - name: fail2ban
    src: https://git.mgrote.net/mg/munin-plugins/raw/branch/master/extern/fail2ban
    config: |
      [fail2ban]
      env.client /usr/bin/fail2ban-client
      env.config_dir /etc/fail2ban
      user root

# Ansible Variablen
### User
ansible_user: "ansible-user"
### SSH
ansible_ssh_common_args: "'-o StrictHostKeyChecking=no'"
### python3
# https://docs.ansible.com/ansible/latest/reference_appendices/python_3_support.html
ansible_python_interpreter: "/usr/bin/python3"

# Ansible Plugin Variablen
### Keepass
# https://github.com/viczem/ansible-keepass
keepass_dbx: "./keepass_db.kdbx"
keepass_psw: !vault |
        $ANSIBLE_VAULT;1.1;AES256
        62383737623066396239383336646164616537646630653964313532383130343533346561633039
        3437306134656535353438666165376332633064383135650a636537626662656130376537633164
        61613132326536666466636632363866393066656236303766333338356337396338376266346631
        6364336331623539300a313562303161373631613734313938346666376239613333333363376236
        38363035376662353135333332363431343833656666643036326234656166643531