---

# ---
# vars used by roles/network_interfaces
# ---


# ---
# vars used by roles/ansible_dependencies
# ---


# ---
# vars used by roles/ansible_user
# ---

insert_root_ssh_keypair: true

root_ssh_keypair:

  - name: id_ed25519-gitea
    priv_key_src: backup.warenform.de/root/.ssh/id_ed25519-gitea
    priv_key_dest: /root/.ssh/id_ed25519-gitea
    pub_key_src: backup.warenform.de/root/.ssh/id_ed25519-gitea.pub
    pub_key_dest: /root/.ssh/id_ed25519-gitea.pub

  - name: borg-client_key
    priv_key_src: backup.warenform.de/root/.ssh/borg-client_key
    priv_key_dest: /root/.ssh/borg-client_key
    pub_key_src: backup.warenform.de/root/.ssh/borg-client_key.pub
    pub_key_dest: /root/.ssh/borg-client_key.pub

  - name: id_ed25519-borg-backup
    priv_key_src: backup.warenform.de/root/.ssh/id_ed25519-borg-backup
    priv_key_dest: /root/.ssh/id_ed25519-borg-backup
    pub_key_src: backup.warenform.de/root/.ssh/id_ed25519-borg-backup.pub
    pub_key_dest: /root/.ssh/id_ed25519-borg-backup.pub

  - name: id_ed25519-backup
    priv_key_src: backup.warenform.de/root/.ssh/id_ed25519-backup
    priv_key_dest: /root/.ssh/id_ed25519-backup
    pub_key_src: backup.warenform.de/root/.ssh/id_ed25519-backup.pub
    pub_key_dest: /root/.ssh/id_ed25519-backup.pub

#  - name: id_rsa
#    priv_key_src: backup.warenform.de/root/.ssh/id_rsa
#    priv_key_dest: /root/.ssh/id_rsa
#    pub_key_src: backup.warenform.de/root/.ssh/id_rsa.pub
#    pub_key_dest: /root/.ssh/id_rsa.pub


# ---
# vars used by roles/common/tasks/basic.yml
# ---


# ---
# vars used by roles/common/tasks/sshd.yml
# ---


# ---
# vars used by roles/common/tasks/apt.yml
# ---

apt_install_extra_pkgs: true
apt_extra_pkgs:
  - subversion
  - subversion-tools


# ---
# vars used by roles/common/tasks/systemd-resolved.yml
# ---

systemd_resolved: true

# CyberGhost - Schnelle Verbindung mit Keine-Logs-Datenschutzrichtlinie
#   Primäre DNS-Adresse: 38.132.106.139
#   Sekundäre DNS-Adresse: 194.187.251.67
#
# Cloudflare (USA) Bester kostenloser DNS-Server für Gaming mit zuverlässigen Verbindungen
#   primäre DNS-Adresse
#      IPv4: 1.1.1.1
#      IPv6: 2606:4700:4700::1111
#   sekundäre DNS-Adresse
#      IPv4: 1.0.0.1
#      IPv6: 2606:4700:4700::1001
#
# Google (USA) Public DNS - Großartige Kombination aus Geschwindigkeit und Sicherheit
#   primäre DNS-Adresse
#      IPv4: 8.8.8.8
#      IPv6: 2001:4860:4860::8888
#   sekundäre DNS-Adresse
#      IPv4: 8.8.4.4
#      IPv6: 2001:4860:4860::8844
#
# Quad9 (CH) - Blockiert mühelos schädliche Seiten und verhindert Phishing-Betrug
#   primäre DNS-Adresse
#      IPv4: 9.9.9.9
#      IPv6: 2620:fe::fe
#   sekundäre DNS-Adresse
#      IPv4: 149.112.112.112
#      IPv6: 2620:fe::9
#
# OpenNIC - https://www.opennic.org/
#      IPv4: 195.10.195.195 - ns31.de
#      IPv4: 94.16.114.254  - ns28.de
#      IPv4: 51.254.162.59  - ns9.de
#      IPv4: 194.36.144.87  - ns29.de
#      IPv6: 2a00:f826:8:2::195 - ns31.de
#
# Freifunk München (normales DNS, DNS-over-TLS und DNS-over-HTTPS)
#    IPv4: 5.1.66.255
#    IPv6: 2001:678:e68:f000::
#    Servername für DNS-over-TLS: dot.ffmuc.net
#    IPv4: 185.150.99.255
#    IPv6: 2001:678:ed0:f000::
#    Servername für DNS-over-TLS: dot.ffmuc.net
#    für iOS 14+: DoT-Server-Konfiguration (unsigniert, vom PrHdb)
resolved_nameserver:
  - 213.133.100.100
  - 2a01:4f8:0:1::add:9898
  - 213.133.99.99
  - 2a01:4f8:0:1::add:1010
  - 213.133.98.98
  - 2a01:4f8:0:1::add:9999


# ---
# vars used by roles/common/tasks/cron.yml
# ---

cron_env_entries:
  - name: PATH
    job: /root/bin/admin-stuff:/root/bin:/usr/local/apache2/bin:/usr/local/php/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin

  - name: SHELL
    job: /bin/bash
    insertafter: PATH


cron_user_special_time_entries:

  - name: "Restart DNS Cache service 'systemd-resolved'"
    special_time: reboot
    job: "sleep 5 ; /bin/systemctl restart systemd-resolved"
    insertafter: PATH

  - name: "Check if postfix mailservice is running. Restart service if needed."
    special_time: reboot
    job: "sleep 10 ; /root/bin/monitoring/check_postfix.sh > /dev/null 2>&1"
    insertafter: PATH


cron_user_entries:

  - name: "Check if SSH service is running. Restart service if needed."
    minute: '*/5'
    hour: '*'
    job: /root/bin/monitoring/check_ssh.sh

  - name: "Check if Postfix Mailservice is up and running?"
    minute: '*/15'
    hour: '*'
    job: /root/bin/monitoring/check_postfix.sh

  - name: "/root/bin/postfix/check-postfix-fatal-errors.sh"
    minute: '*/17'
    hour: '*'
    job: /root/bin/postfix/check-postfix-fatal-errors.sh

  - name: "Check if remote website is online"
    minute: '*/15'
    hour: '7-23'
    job: /root/bin/monitoring/check_remote_websites.sh

  - name: "Remote Borg2 Backup"
    minute: '02'
    hour: '00'
    job: /root/crontab/backup-rborg2/rborg2.sh


# ---
# vars used by roles/common/tasks/users.yml
# ---

insert_ssh_keypair_backup_server: false




default_user:

  - name: chris
    password: $6$bSHlaLHC$URSMVq090e/cJ1v55Jh9ws0w5WekhO7X3Y0RqryAl5R76K9khWBegC76Smjastja.xMiD57/LzUUXW7y9NvAL.
    shell: /bin/bash
    ssh_keys:
      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'

  - name: axel
    password: $6$zUWC465e$XblctxwnBIOa7mPcN6foEQrwChjpwoY7lLtacXJrSsvjZS3I6Ox1mYUtN3/gzkvpbzOPx/9PlRJV.mbl939mD.
    shell: /bin/bash
    ssh_keys:
      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICOPnP788dlfeFi9oo8UkS0Chi/jcxUGjsOuQnxW/GR+ axel@wf.netz'

  - name: sysadm
    user_id: 1050
    group_id: 1050
    password: $6$vvccwrTc$Sz1HaSb3ujObprltiG7D6U1Rr3fpgfjkKuDDWYdHzPkPx/0pEofCWC.vyTn78hcemkntl.6wVUOnJnNloKt/E/
    shell: /bin/bash
    ssh_keys:
      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICOPnP788dlfeFi9oo8UkS0Chi/jcxUGjsOuQnxW/GR+ axel@wf.netz'

  - name: localadmin
    user_id: 1051
    group_id: 1051
    password: $6$flo5afeu$1Dn/tqIOJIFQbymCzpJk9BgGflQdy2Eg0nTiMBF7VefN7uY/Md1pV2yU0S47kZuH5aDjSdPfKzhHp8Aul/xx90
    shell: /bin/bash
    ssh_keys:
      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'

  - name: back
    user_id: 1060
    group_id: 1060
    password: $6$GntX81EP$O1GEmQF.BbOQfTMMw/m/BDKSXmANVpqmz0nyzw4O4R2/iK9huGOAjT/2eq8FVdMghvNOvdwrWtwohO.Mg4V9n.
    shell: /bin/bash
    ssh_keys:
      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKd0AwTHbDBK4Dgs+IZWmtnDBjoVIogOUvkLIYvsff1y root@backup.open.de'
      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINj0nCdFOZm51AVCfPbZ22QROIEiboXZ7RamHvM2E9IM root@backup.warenform.de'
      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBZQMCGCyIvs5hoNDoTIkKvKmEbxLf+uCYI1vx//ZQYY root@o26-backup'

  - name: borg
    user_id: 1065
    group_id: 1065
    group: borg
    password: $y$j9T$JPKlR6kIk7GJStSdmAQWq/$e1vJER6KL/dk1diFNtC.COw9lu2uT6ZdrUgGcNVb912
    shell: /bin/bash
    ssh_keys:
      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFstQOOM/U18SV27+XTtBhso+vICK5L4aOGC83QnvS8+ root@o19'
      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDqqmBWh3qmnx41NiLCn1LhVG0mn4++IUvRNC0OMh6h6 root@gitea.oopen.de'
      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMtIXFS9OrKBvBl+fKtYN/lOOKpPuuc02H8HV+++LeBU root@backup.oopen.de'
      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIE1RkJYM8qcEagoKt9gNVaeBbXZEJscqIBNnhL/KZfSA root@munin.oopen.de'
      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIj2SdZgxG4NCjUiCXY7msCG+Vn6MQ5jsGxrs2qn1QZh root@mx'
      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHQAvCK/h7+8h8hPm3WyeEdBbhY4SdOSWJYxuFW24XbM root@nd'
      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBOOYhdtNPAQP8BlgSYBaMfWl8Yv4Y9ww7SWeLOn0HXH root@web0'


sudo_users:
  - chris
  - axel
  - sysadm
  - localadmin


# ---
# vars used by roles/common/tasks/users-systemfiles.yml
# ---


# ---
# vars used by roles/common/tasks/webadmin-user.yml
# ---


# ---
# vars used by roles/common/tasks/sudoers.yml
# ---
#
# see: roles/common/tasks/vars


# ---
# vars used by roles/common/tasks/caching-nameserver.yml
# ---


# ---
# vars used by roles/common/tasks/git.yml
# ---

git_firewall_repository:
  name: ipt-server
  repo: https://git.oopen.de/firewall/ipt-server
  dest: /usr/local/src/ipt-server


# ==============================


# ---
# vars used by scripts/reset_root_passwd.yml
# ---

root_user:
  name: root
  password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq.

