ansible cleanup

ansible/inventory/group_vars/all/main.yaml

@@ -1,21 +0,0 @@
----
-# Shared configuration for all servers
-
-# Docker network for Traefik
-traefik_network: traefik
-
-# Forgejo configuration
-forgejo_version: "12"
-forgejo_domain: git.asxp.io
-forgejo_http_port: 3000
-forgejo_ssh_port: 2222  # External port (container uses 22)
-
-# Forgejo Runner configuration
-forgejo_runner_version: "11"
-forgejo_runner_capacity: 1
-forgejo_runner_timeout: 3h
-forgejo_runner_token: "{{ vault_forgejo_runner_token }}"
-
-# Backup configuration
-backup_dest_dir: /opt/forgejo-backup
-backup_old_server: asxpio-old

ansible/inventory/group_vars/all/paths.yaml

@@ -0,0 +1,5 @@
+---
+# Base paths for all services
+
+# Base directory for all service installations
+services_base_path: "/opt"

ansible/inventory/group_vars/all/services.yaml

@@ -1,30 +0,0 @@
----
-# Service configuration for all hosts
-# Centralized service definitions to avoid hardcoding paths and ports
-
-# Base paths for services
-services_base_path: "/opt"
-
-# Service-specific paths (derived from base path)
-traefik_base_path: "{{ services_base_path }}/traefik"
-forgejo_base_path: "{{ services_base_path }}/forgejo"
-forgejo_runner_base_path: "{{ services_base_path }}/forgejo-runner"
-
-# Service ports
-traefik_http_port: 80
-traefik_https_port: 443
-traefik_dashboard_port: 8080
-
-forgejo_http_port: 3000
-forgejo_ssh_port: 2222  # External SSH port for Git operations
-forgejo_internal_ssh_port: 22  # Internal container SSH port
-
-# WireGuard configuration
-wireguard_port: 60101
-wireguard_interface: "wg0"
-
-# SSH configuration
-ssh_port: 22
-
-# Docker configuration
-docker_network_name: "asxpio-net"

ansible/inventory/group_vars/all/wireguard.yaml

@@ -0,0 +1,38 @@
+---
+# WireGuard VPN configuration
+# Centralized configuration for all WireGuard settings
+
+# WireGuard network interface and port
+wireguard_port: 60101
+wireguard_interface: "wg0"
+
+# WireGuard server configuration (asxpio-ops)
+wireguard_ipv4: 10.20.0.10
+wireguard_ipv6: fd69:69:69::1
+wireguard_ipv4_network: 10.20.0.0/24
+wireguard_ipv6_network: fd69:69:69::/64
+
+# Enable UFW firewall rules (set to false to use iptables PostUp/PostDown)
+wireguard_enable_ufw: false
+
+# WireGuard clients
+wireguard_clients:
+  - name: asxpio-services
+    ipv4: 10.20.0.20
+    ipv6: fd69:69:69::20
+    preshared_key: true
+    persistent_keepalive: 25
+  - name: laptop
+    ipv4: 10.20.0.2
+    ipv6: fd69:69:69::2
+    preshared_key: true
+    persistent_keepalive: 25
+
+# DNS servers for VPN clients
+wireguard_dns_servers:
+  - 1.1.1.1
+  - 1.0.0.1
+
+# Optional: Additional routes for split tunneling
+# wireguard_additional_routes:
+#   - 192.168.1.0/24