# --- Identity ---
fqdn: "bbb.chezlepro.ca"

# --- Admin user + keys ---
admin_user: "ansible"
admin_pubkeys:
  - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILKb7XpYYfKuoBIVprPYX1VVdebRMvpiV2NcsZYaYzbP Cle ansible pour le royaume chezlepro"

# --- SSH hardening ---
ssh_port: 22
ssh_allow_cidrs_v4:
  - "69.70.26.50/31"  # .50-.51
  - "69.70.26.52/30"  # .52-.55
  - "69.70.26.56/30"  # .56-.59
  - "69.70.26.60/31"  # .60-.61
  - "69.70.26.62/32"  # .62

ssh_allow_cidrs_v6: ["::1/128"]

ssh_allow_users: ["ansible"]

disable_password_auth: true
permit_root_login: "no"

# --- BBB ports ---
bbb_udp_min: 16384
bbb_udp_max: 32768

# --- TURN cohabitation (1 IP) ---
turn_enabled: true
turn_listen_port: 3478          # TCP/UDP
turn_tls_port: 5349             # TURN over TLS (standard). 443 est conflictuel sur 1 IP avec nginx/BBB
turn_relay_udp_min: 50000
turn_relay_udp_max: 55000

# --- Hardening toggles ---
enable_unattended_upgrades: true
enable_fail2ban: true
journald_persistent: true

# --- Swap (utile avec 12G RAM) ---
manage_swapfile: true
swapfile_path: /swapfile
swapfile_size_mb: 8192

# --- Docker (BBB 3.x requires latest docker) ---
docker_install: true
docker_add_admin_to_group: false   # IMPORTANT: groupe docker = root-equivalent