inventory.yml

# Please don't edit this file directly! It will be reset when you update the git repository
# Instead, put your variable customizations into custom.yml

all:
  hosts:
    localhost:
      ansible_connection: local

  vars:
    username: notthebee

    root_host: example.duckdns.org

    enable_username_creation: yes

    user_shell: /bin/bash

    enable_passwordless_sudo: yes

    # Whether or not you want to generate a public key pair for SSH auth
    # The playbook will not generate a new pair if $HOME/.ssh/authorized_keys exists and isn't empty
    enable_ssh_keygen: yes

    # Uncomment this line if you already have a public SSH key and put your public key in it
    # This overrides `enable_ssh_keygen`
    # ssh_public_key: ""

    authelia_host: "auth.{{ root_host }}"

    wireguard_host: "wg.{{ root_host }}"

    wireguard_port: "51820"

    dns_nameservers:
      - 1.1.1.1
      - 1.0.0.1

    # Language and time settings
    # Check here for the list of possible locales
    # https://docs.oracle.com/cd/E23824_01/html/E26033/glset.html
    locale: en_US.UTF-8

    timezone: Europe/Berlin

    # Set the time at which the system should reboot after installing updates (24H format)
    autoupdate_reboot_time: 03:00

    docker_dir: "/opt/docker"

    # You can set it to a different port in order to avoid automated scanner bots
    ssh_port: 22

    # Optional e-mail for notifications (unattended upgrades, banned IPs, etc.)
    # Leave everything in place if you don't want any notifications
    email_login: root@localhost

    email: "{{ email_login }}"

    email_recipient: "{{ email_login }}"

    email_smtp_host: smtp.localhost.com

    email_smtp_port: 465

    # MSMTP
    msmtp_accounts:
      - account: mailbox
        host: "{{ email_smtp_host }}"
        port: "{{ email_smtp_port }}"
        auth: "on"
        from: "{{ email }}"
        user: "{{ email_login }}"
        password: "{{ email_password }}"

    msmtp_default_account: "mailbox"

    msmtp_alias_default: "{{ email }}"

    # By default, only access via the SSH port and 51820/udp is allowed
    # The rest of the ports are closed
    enable_ufw: true
    ufw_ports:
      - port: "{{ wireguard_port }}"
        proto: "udp"
      - port: "80"
        proto: "tcp"
      - port: "443"
        proto: "tcp"
      - port: "{{ ssh_port }}"
        proto: "tcp"

    # Fail2Ban only comes with the SSH jail by default
    enable_fail2ban: true