vars.yml

#
# Do not edit this file directly
# Instead, add your customizations to group_vars/your-inventory-name/vars.yml
# For secret variables, use group_vars/your-inventory-name/vault.yml
#

#
# Misc
#
timezone: Europe/Amsterdam

dns_nameservers: [9.9.9.9, 149.112.112.112]

dot_nameservers: [185.95.218.42@853#dns.digitale-gesellschaft.ch, 94.140.15.140@853#dns-unfiltered.adguard.com]

ntp_timezone: "{{ timezone }}"

locale: en_US.UTF-8

lan_network: "{{ '.'.join(ansible_default_ipv4.address.split('.')[0:3]) }}.0/24"

fish_prompt_color: blue 

keyboard_layout: us

username: notthebee

guid: "1000"

shell: /usr/bin/fish

docker_dir: /opt/docker/data

dotfiles_repo: https://github.com/notthebee/dotfiles

boot_drive_serial: ""

enable_pikvm: true

pikvm_address: pikvm.box

spindown_time: 600 # in seconds

colorscheme: nord

#
# Packages
#
extra_packages:
  - fish
  - iperf3
  - speedtest-cli
  - htop
  - stow
  - git
  - neofetch
  - neovim
  - tmux
  - mosh
  - rsync
  - lm-sensors
  - iotop
  - ncdu
  - hddtemp
  - reptyr

#
# Apt mirrors
#
version: focal

apt_mirror: http://ftp.uni-mainz.de/ubuntu/


#
# Email credentials (for SMART and Snapraid error reporting)
#

email: moe@notthebe.ee

email_login: "{{ email }}"

email_smtp_host: smtp.mailbox.org

email_smtp_port: 465

email_smtp_port_startls: 587

# MSMTP 
msmtp_accounts:
- account:   mailbox
  host:      "{{ email_smtp_host }}"
  port:      "{{ email_smtp_port_startls }}"
  auth:      "on"
  from:      "{{ email }}"
  user:      "{{ email }}"
  password:  "{{ email_password }}"

msmtp_default_account: "mailbox"

msmtp_alias_default : "{{ email }}"

#
# SSH (geerlingguy.security)
#
security_ssh_port: 69

security_sudoers_passwordless: [ "{{ username }}" ]

security_autoupdate_reboot: "true"

security_autoupdate_mail_to: "{{ email }}"

security_autoupdate_mail_on_error: true

security_fail2ban_enabled: false

#
# Enable/disable individual Docker containers
#

# Home automation

enable_deconz: true

enable_homeassistant: true

# Media

enable_plex: false

enable_jellyfin: true

enable_photoprism: true

enable_booksonic: true

# Yo-ho-ho

enable_deluge: true

enable_sonarr: true

enable_radarr: true

enable_openbooks: true


enable_jackett: true

# Public-facing services

enable_nextcloud: true

enable_vaultwarden: true

enable_swag: true

# DDNS

enable_duckdns: false

enable_cloudflare-ddns: true

enable_ddclient: true

# VPN

enable_wireguard: true

enable_ikev2: true

# Homepages

enable_homer: true

enable_flame: false

# Misc

enable_unifi: false

enable_authelia: true

enable_pihole: true

enable_watchtower: true

#
# Time Machine
#
timemachine_root: /mnt/timemachine

timemachine_drive: /dev/disk/by-label/TimeMachine

enable_timemachine: true

#
# IKEv2
#
ikev2_ondemand: true



#
# Samba
#
enable_samba: true

samba_server_string: "{{ hostname }}"

samba_users:
  - name: "{{ username }}"
    password: "{{ password }}"
  - name: "{{ additional_users[0].name }}"
    password: "{{ password2 }}"

samba_global_include: global-include.conf

samba_apple_extensions: yes 

samba_mitigate_cve_2017_7494: false

samba_server_max_protocol: "SMB3"

samba_server_min_protocol: "SMB3"

samba_shares:
  - name: Trash
    guest_ok: no
    public: no
    read_only: no
    writable: yes
    owner: "{{ username }}"
    browseable: yes
    path: "{{ mergerfs_root }}"
    valid_users: "{{ username }}"
    write_list: "{{ username }}"
      
  - name: Downloads
    guest_ok: no
    public: no
    read_only: no
    writable: yes
    browseable: yes
    owner: "{{ username }}"
    path: "{{ mergerfs_root }}/Downloads"
    valid_users: "{{ username }}, {{ additional_users[0].name }}"
    write_list: "{{ username }}, {{ additional_users[0].name }}"
 
  - name: Media
    guest_ok: no
    public: no
    read_only: no
    writable: yes
    browseable: yes
    owner: "{{ username }}"
    path: "{{ mergerfs_root }}/Media"
    valid_users: "{{ username }}, {{ additional_users[0].name }}"
    write_list: "{{ username }}, {{ additional_users[0].name }}"

  - name: TimeMachine
    guest_ok: no
    public: no
    read_only: no
    owner: "{{ username }}"
    vfs_objects:
      - name: fruit
        options:
        - name: time machine
          value: 'yes'
      - name: streams_xattr
    writable: yes
    browseable: yes
    path: "{{ timemachine_root }}"
    valid_users: "{{ username }}"
    write_list: "{{ username }}"

#
# Snapraid and MergerFS
#
mergerfs_root: /mnt/storage

disks:
  - { path: /mnt/data1, src: /dev/disk/by-label/Data1, content: true }
  - { path: /mnt/data2, src: /dev/disk/by-label/Data2, content: true }
  - { path: /mnt/data3, src: /dev/disk/by-label/Data3, content: true }

cache_disks:
  - { path: /mnt/cache1, src: /dev/disk/by-label/Cache1, content: true }

parity_disks:
  - { path: /mnt/parity1, src: /dev/disk/by-label/Parity1, content: true }

snapraid_data_disks: "{{ disks }}"

snapraid_parity_disks: "{{ parity_disks }}"

snapraid_runner_gmail_pass: "{{ email_password }}"

snapraid_runner_email_address: "{{ email }}"

snapraid_runner_email_address_from: "{{ snapraid_runner_email_address }}"

snapraid_runner_email_address_to: "{{ snapraid_runner_email_address }}"

snapraid_runner_smtp_host: "{{ email_smtp_host }}"

snapraid_runner_smtp_port: "{{ email_smtp_port }}"

snapraid_runner_command: "python3 {{ snapraid_runner_bin }} -c {{ snapraid_runner_conf }}"

# Stop all the docker containers, backup the {{ docker_dir }} to the MergerFS pool, execute the snapraid runner and start the containers back up
# Stopping the containers is necessary – backing up the data folder with the containers running will result in corrputed database files and no files can be changed during the Snapraid sync
snapraid_runner_cron_jobs:
  - { job: 'docker stop $(docker ps -q); rsync -avz --delete --exclude cache {{ docker_dir }} {{ mergerfs_root }}/docker_data; docker start $(docker ps -a -q) && {{ snapraid_runner_command }} ', name: 'snapraid_runner', weekday: '0', hour: '3' }

snapraid_runner_delete_threshold: 999999

snapraid_runner_email_sendon: "error"

snapraid_runner_use_ssl: true

snapraid_content_files:
  - /var/snapraid.content

snapraid_config_excludes:
  - "*.unrecoverable"
  - /lost+found/
  - "*.!sync"
  - /tmp/
  - "/Downloads/*"

#
# SMART error reporting
#
smartd_default_mail_recipients: [ "{{ email }}" ]
### BEGIN Secret variables (encrypt and put into vault.yml)
cloudflare_dns_token: ''
cloudflare_firewall_token: ''
email_password: ''
host: ''
host_local: ''
ikev2_excludedssids: ''
namecheap_host: ''
namecheap_token: ''
password: ''
photoprism_password: ''
pihole_password: ''
pikvm_password: ''
piped_postgresql_password: ''
ssh_public_key: ''
subdomains: ''
swag_htpasswd_password: ''
swag_htpasswd_user: ''
vpn_host: ''
vpn_password: ''
### END Secret variables (encrypt and put into vault.yml)