56 lines
1.7 KiB
YAML
56 lines
1.7 KiB
YAML
# --- Identity ---
|
|
fqdn: "bbb.chezlepro.ca"
|
|
|
|
# --- Admin user + keys ---
|
|
admin_user: "ansible"
|
|
admin_pubkeys:
|
|
- "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILKb7XpYYfKuoBIVprPYX1VVdebRMvpiV2NcsZYaYzbP Cle ansible pour le royaume chezlepro"
|
|
|
|
# --- SSH hardening ---
|
|
ssh_port: 22
|
|
ssh_allow_cidrs_v4:
|
|
- "69.70.26.50/31" # .50-.51
|
|
- "69.70.26.52/30" # .52-.55
|
|
- "69.70.26.56/30" # .56-.59
|
|
- "69.70.26.60/31" # .60-.61
|
|
- "69.70.26.62/32" # .62
|
|
|
|
ssh_allow_cidrs_v6: ["::1/128"]
|
|
|
|
ssh_allow_users: ["ansible"]
|
|
|
|
disable_password_auth: true
|
|
permit_root_login: "no"
|
|
|
|
# --- BBB ports ---
|
|
bbb_udp_min: 16384
|
|
bbb_udp_max: 32768
|
|
|
|
# --- TURN cohabitation (1 IP) ---
|
|
# BBB 3.x installe un TURN local + HAProxy pour partager le port 443 avec HTTPS (recommandé pour les réseaux restrictifs).
|
|
turn_enabled: true
|
|
turn_listen_port: 3478 # TCP/UDP
|
|
turn_tls_port: 443 # TCP/UDP (TURN on 443 via haproxy, cohabite avec HTTPS)
|
|
turn_relay_udp_min: 50000
|
|
turn_relay_udp_max: 55000
|
|
|
|
# --- Hardening toggles ---
|
|
enable_unattended_upgrades: true
|
|
enable_fail2ban: true
|
|
journald_persistent: true
|
|
|
|
# --- Swap (utile avec 12G RAM) ---
|
|
manage_swapfile: true
|
|
swapfile_path: /swapfile
|
|
swapfile_size_mb: 8192
|
|
|
|
# --- Docker (BBB 3.x requires latest docker) ---
|
|
docker_install: true
|
|
docker_add_admin_to_group: false # IMPORTANT: groupe docker = root-equivalent
|
|
|
|
# --- BBB install (via bbb-install.sh) ---
|
|
bbb_install_enabled: true
|
|
bbb_version: "jammy-300" # installe toujours la dernière 3.0.x
|
|
letsencrypt_email: "allaire.dan@chezlepro.ca" # OBLIGATOIRE: email pour Let's Encrypt (ex: ops@chezlepro.ca)
|
|
bbb_skip_min_requirements: true # -j: utile si IPv6 désactivé ou serveur < recommandations prod
|
|
bbb_install_greenlight: true # -g (optionnel)
|