48 lines
1.2 KiB
YAML
48 lines
1.2 KiB
YAML
# --- Identity ---
|
|
fqdn: "bbb.chezlepro.ca"
|
|
|
|
# --- Admin user + keys ---
|
|
admin_user: "ansible"
|
|
admin_pubkeys:
|
|
- "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILKb7XpYYfKuoBIVprPYX1VVdebRMvpiV2NcsZYaYzbP Cle ansible pour le royaume chezlepro"
|
|
|
|
# --- SSH hardening ---
|
|
ssh_port: 22
|
|
ssh_allow_cidrs_v4:
|
|
- "69.70.26.50/31" # .50-.51
|
|
- "69.70.26.52/30" # .52-.55
|
|
- "69.70.26.56/30" # .56-.59
|
|
- "69.70.26.60/31" # .60-.61
|
|
- "69.70.26.62/32" # .62
|
|
|
|
ssh_allow_cidrs_v6: ["::1/128"]
|
|
|
|
ssh_allow_users: ["ansible"]
|
|
|
|
disable_password_auth: true
|
|
permit_root_login: "no"
|
|
|
|
# --- BBB ports ---
|
|
bbb_udp_min: 16384
|
|
bbb_udp_max: 32768
|
|
|
|
# --- TURN cohabitation (1 IP) ---
|
|
turn_enabled: true
|
|
turn_listen_port: 3478 # TCP/UDP
|
|
turn_tls_port: 5349 # TURN over TLS (standard). 443 est conflictuel sur 1 IP avec nginx/BBB
|
|
turn_relay_udp_min: 50000
|
|
turn_relay_udp_max: 55000
|
|
|
|
# --- Hardening toggles ---
|
|
enable_unattended_upgrades: true
|
|
enable_fail2ban: true
|
|
journald_persistent: true
|
|
|
|
# --- Swap (utile avec 12G RAM) ---
|
|
manage_swapfile: true
|
|
swapfile_path: /swapfile
|
|
swapfile_size_mb: 8192
|
|
|
|
# --- Docker (BBB 3.x requires latest docker) ---
|
|
docker_install: true
|
|
docker_add_admin_to_group: false # IMPORTANT: groupe docker = root-equivalent
|