67 lines
2.4 KiB
YAML
67 lines
2.4 KiB
YAML
---
|
|
# Host-specific configuration for asxpio-ops
|
|
# Operations server: Forgejo, Traefik, WireGuard VPN hub
|
|
|
|
# ============================================================================
|
|
# WireGuard VPN Configuration
|
|
# ============================================================================
|
|
wireguard_port: 60101
|
|
wireguard_interface: wg0
|
|
wireguard_ipv4: 10.20.0.10
|
|
wireguard_ipv6: fd69:69:69::1
|
|
wireguard_ipv4_network: 10.20.0.0/24
|
|
wireguard_ipv6_network: fd69:69:69::/64
|
|
|
|
# Enable UFW firewall rules (set to false to use iptables PostUp/PostDown)
|
|
wireguard_enable_ufw: false
|
|
|
|
# WireGuard clients
|
|
wireguard_clients:
|
|
- name: asxpio-services
|
|
ipv4: 10.20.0.20
|
|
ipv6: fd69:69:69::20
|
|
preshared_key: true
|
|
persistent_keepalive: 25
|
|
- name: laptop
|
|
ipv4: 10.20.0.2
|
|
ipv6: fd69:69:69::2
|
|
preshared_key: true
|
|
persistent_keepalive: 25
|
|
|
|
# Optional: DNS servers for clients
|
|
wireguard_dns_servers:
|
|
- 1.1.1.1
|
|
- 1.0.0.1
|
|
|
|
# Optional: Additional routes for split tunneling
|
|
# wireguard_additional_routes:
|
|
# - 192.168.1.0/24
|
|
|
|
# ============================================================================
|
|
# SSH Hardening Configuration
|
|
# ============================================================================
|
|
# Allow public SSH access for Forgejo git operations
|
|
ssh_allow_public_git: true
|
|
ssh_git_user: git
|
|
|
|
# ============================================================================
|
|
# Forgejo Configuration
|
|
# ============================================================================
|
|
# Secrets are stored in encrypted vault (group_vars/all/vault.yaml)
|
|
forgejo_secret_key: "{{ vault_forgejo_secret_key }}"
|
|
forgejo_internal_token: "{{ vault_forgejo_internal_token }}"
|
|
forgejo_jwt_secret: "{{ vault_forgejo_jwt_secret }}"
|
|
forgejo_lfs_jwt_secret: "{{ vault_forgejo_lfs_jwt_secret }}"
|
|
|
|
# ============================================================================
|
|
# SSL/TLS Configuration
|
|
# ============================================================================
|
|
letsencrypt_email: "{{ vault_letsencrypt_email }}"
|
|
|
|
# ============================================================================
|
|
# S3FS Configuration
|
|
# ============================================================================
|
|
# ops server: CX22 with 40GB disk, limit cache to 10GB
|
|
# Formula: Total_Disk - Desired_Cache_Size = ensure_diskfree
|
|
# 40GB - 10GB = 30GB free
|
|
s3fs_ensure_diskfree: 30720 # 30GB free = max 10GB cache
|