---
# SSH Hardening Role Default Variables

# Networks allowed to access SSH (VPC and WireGuard)
# These reference the centralized network variables from group_vars/network.yaml
ssh_allowed_networks:
  - "{{ wireguard_network }}"  # WireGuard VPN
  - "{{ vpc_network }}"  # Internal VPC

# Whether to allow public SSH access for git operations (Forgejo)
# Set to true on Forgejo host, false on other servers
ssh_allow_public_git: false

# Shell users that require network restrictions
ssh_shell_users:
  - asxpi
  - zerrtika
  - deploy
  - root

# Git user for Forgejo (allowed from anywhere when ssh_allow_public_git is true)
ssh_git_user: git

# SSH hardening settings
ssh_max_auth_tries: 3
ssh_max_sessions: 5
ssh_client_alive_interval: 300
ssh_client_alive_count_max: 2

# Strong cryptography settings
ssh_ciphers:
  - chacha20-poly1305@openssh.com
  - aes256-gcm@openssh.com
  - aes128-gcm@openssh.com
  - aes256-ctr
  - aes192-ctr
  - aes128-ctr

ssh_macs:
  - hmac-sha2-512-etm@openssh.com
  - hmac-sha2-256-etm@openssh.com
  - hmac-sha2-512
  - hmac-sha2-256

ssh_kex_algorithms:
  - sntrup761x25519-sha512@openssh.com  # Post-quantum hybrid (OpenSSH 9.0+)
  - curve25519-sha256
  - curve25519-sha256@libssh.org
  - diffie-hellman-group-exchange-sha256
  - diffie-hellman-group16-sha512
  - diffie-hellman-group18-sha512

# Public key algorithms (includes RSA-SHA2 for existing keys)
ssh_pubkey_accepted_algorithms:
  - ssh-ed25519
  - ssh-ed25519-cert-v01@openssh.com
  - sk-ssh-ed25519@openssh.com
  - ecdsa-sha2-nistp256
  - ecdsa-sha2-nistp384
  - ecdsa-sha2-nistp521
  - rsa-sha2-512
  - rsa-sha2-256