# --- Identity ---
fqdn: "bbb.chezlepro.ca"

# --- Admin user + keys ---
admin_user: "ansible"
admin_pubkeys:
  - "ssh-ed25519 AAAA...REMPLACE... ton_key_ed25519 ..."

# --- SSH hardening ---
ssh_port: 22
ssh_allow_cidrs_v4: ["0.0.0.0/0"]   # RECO: remplace par ton IP fixe (ex: "1.2.3.4/32")
ssh_allow_cidrs_v6: ["::/0"]        # RECO: remplace par ton IP /128 si applicable
ssh_allow_users: ["ansible"]

disable_password_auth: true
permit_root_login: "no"

# --- BBB ports ---
bbb_udp_min: 16384
bbb_udp_max: 32768

# --- TURN cohabitation (1 IP) ---
turn_enabled: true
turn_listen_port: 3478          # TCP/UDP
turn_tls_port: 5349             # TURN over TLS (standard). 443 est conflictuel sur 1 IP avec nginx/BBB
turn_relay_udp_min: 32769
turn_relay_udp_max: 65535

# --- Hardening toggles ---
enable_unattended_upgrades: true
enable_fail2ban: true
journald_persistent: true

# --- Swap (utile avec 12G RAM) ---
manage_swapfile: true
swapfile_path: /swapfile
swapfile_size_mb: 8192

# --- Docker (BBB 3.x requires latest docker) ---
docker_install: true
docker_add_admin_to_group: false   # IMPORTANT: groupe docker = root-equivalent