---
# KNELIAC default variables.
#
# These mirror the values hard-coded in the legacy bash
# PFVCluster/provisioning/ scripts. Override any of them in AWX via
# "extra vars" on the Job Template, or per-host in group_vars/host_vars.

# ---------------------------------------------------------------------------
# Users provisioned on every host. Keys under ssh_authorized_keys must already
# exist in roles/security_ssh/files/authorized_keys/.
# ---------------------------------------------------------------------------
managed_users:
  - name: root
    home: /root
  - name: localuser
    home: /home/localuser
  - name: subodev
    home: /home/subodev

# ---------------------------------------------------------------------------
# Networking: authoritative recursive DNS + NTP servers (pfv-netinfra-01/02).
# ---------------------------------------------------------------------------
dns_servers:
  - 192.168.3.252
  - 192.168.3.253

dns_search_domain: knel.net

ntp_servers:
  - 192.168.3.252
  - 192.168.3.253

# Hostnames of NTP servers that must NOT get client config are now managed
# via the 'ntp_servers' inventory group (see inventory/hosts.yml). The
# preflight role sets is_ntp_server based on group membership.

# ---------------------------------------------------------------------------
# Mail (postfix) — local-only relay to the Cloudron smarthost.
# ---------------------------------------------------------------------------
postfix_relayhost: tsys-cloudron.knel.net
postfix_generic_address: tsysrootaccount@knel.net

# Syslog forward destination (LibreNMS receiver).
syslog_forward_host: tsys-librenms.knel.net

# ---------------------------------------------------------------------------
# SNMP
# ---------------------------------------------------------------------------
snmp_rocommunity: kn3lmgmt
snmp_syslocation: "R4, Server Room, SITER, Pflugerville, United States"
snmp_syscontact: coo@turnsys.com

# ---------------------------------------------------------------------------
# Monitoring / security agents
# ---------------------------------------------------------------------------
wazuh_manager: tsys-nsm.knel.net
# Hostnames that must NOT receive the wazuh agent (the wazuh server itself).
# The Wazuh manager server is now managed via the 'wazuh_server' inventory
# group (see inventory/hosts.yml). The preflight role sets is_wazuh_server.
wazuh_server_hostnames_deprecated: []

# The LibreNMS server is now managed via the 'librenms_server' inventory
# group (see inventory/hosts.yml). The preflight role sets is_librenms_server.

# Tailscale (installer only auths the machine; no token stored here).
tailscale_install: true

# Webmin/Usermin (used for PAM 2FA management).
webmin_setup: true

# ---------------------------------------------------------------------------
# Packages
# ---------------------------------------------------------------------------
# Packages removed from every host during provisioning.
packages_remove:
  - systemd-timesyncd
  - chrony
  - telnet
  - inetutils-telnet
  - wpasupplicant
  - modemmanager
  - nano
  - multipath-tools

# Packages installed on every host during provisioning.
packages_install:
  - virt-what
  - auditd
  - audispd-plugins
  - cloud-guest-utils
  - aide
  - htop
  - snmpd
  - ncdu
  - iftop
  - iotop
  - cockpit
  - cockpit-bridge
  - cockpit-doc
  - cockpit-networkmanager
  - cockpit-packagekit
  - cockpit-pcp
  - cockpit-sosreport
  - cockpit-storaged
  - cockpit-system
  - cockpit-ws
  - nethogs
  - sysstat
  - ngrep
  - acct
  - lsb-release
  - screen
  - tailscale
  - tmux
  - vim
  - command-not-found
  - lldpd
  - ansible-core
  - net-tools
  - dos2unix
  - gpg
  - molly-guard
  - lshw
  - fzf
  - ripgrep
  - sudo
  - mailutils
  - clamav
  - logwatch
  - git
  - tshark
  - tcpdump
  - lynis
  - glances
  - zsh
  - zsh-autosuggestions
  - zsh-syntax-highlighting
  - fonts-powerline
  - webmin
  - usermin
  - ntpsec
  - ntpsec-ntpdate
  - tuned
  - iptables
  - netfilter-persistent
  - iptables-persistent
  - pflogsumm
  - postfix

# Packages only installed on bare-metal Dell hosts AND Proxmox VE hosts
# (both need CPU frequency tools and thermal management).
packages_physical_host:
  - i7z
  - thermald
  - cpufrequtils
  - linux-cpupower

# Packages installed only on KVM/libvirt guests.
packages_virtual_guest:
  - qemu-guest-agent

# Packages that conflict with Proxmox VE — excluded from the install list
# on PVE hosts. Cockpit conflicts with the PVE web UI; tuned conflicts with
# PVE's own CPU governor management.
packages_proxmox_skip:
  - cockpit
  - cockpit-bridge
  - cockpit-doc
  - cockpit-networkmanager
  - cockpit-packagekit
  - cockpit-pcp
  - cockpit-sosreport
  - cockpit-storaged
  - cockpit-system
  - cockpit-ws
  - cockpit-tests
  - tuned

# Packages known to be unavailable or renamed on Kali Linux.
# These are filtered out of the install list on Kali hosts.
packages_kali_skip:
  - latencytop
  - cockpit-tests
  - command-not-found
  - fonts-powerline

# Packages installed only on non-Kali hosts (legacy packages_non_kali).
packages_non_kali:
  - latencytop
  - cockpit-tests

# ---------------------------------------------------------------------------
# Feature toggles — set false to skip a phase.
# ---------------------------------------------------------------------------
run_packages: true
run_system_config: true
run_oam: true
run_security_ssh: true
run_security_wazuh: true
run_security_2fa: true
run_security_scap_stig: true
run_security_audit: false   # was commented out in the legacy runner