41 lines
1.1 KiB
YAML
41 lines
1.1 KiB
YAML
# --- Identity ---
|
|
fqdn: "bbb.chezlepro.ca"
|
|
|
|
# --- Admin user + keys ---
|
|
admin_user: "ansible"
|
|
admin_pubkeys:
|
|
- "ssh-ed25519 AAAA...REMPLACE... ton_key_ed25519 ..."
|
|
|
|
# --- SSH hardening ---
|
|
ssh_port: 22
|
|
ssh_allow_cidrs_v4: ["0.0.0.0/0"] # RECO: remplace par ton IP fixe (ex: "1.2.3.4/32")
|
|
ssh_allow_cidrs_v6: ["::/0"] # RECO: remplace par ton IP /128 si applicable
|
|
ssh_allow_users: ["ansible"]
|
|
|
|
disable_password_auth: true
|
|
permit_root_login: "no"
|
|
|
|
# --- BBB ports ---
|
|
bbb_udp_min: 16384
|
|
bbb_udp_max: 32768
|
|
|
|
# --- TURN cohabitation (1 IP) ---
|
|
turn_enabled: true
|
|
turn_listen_port: 3478 # TCP/UDP
|
|
turn_tls_port: 5349 # TURN over TLS (standard). 443 est conflictuel sur 1 IP avec nginx/BBB
|
|
turn_relay_udp_min: 32769
|
|
turn_relay_udp_max: 65535
|
|
|
|
# --- Hardening toggles ---
|
|
enable_unattended_upgrades: true
|
|
enable_fail2ban: true
|
|
journald_persistent: true
|
|
|
|
# --- Swap (utile avec 12G RAM) ---
|
|
manage_swapfile: true
|
|
swapfile_path: /swapfile
|
|
swapfile_size_mb: 8192
|
|
|
|
# --- Docker (BBB 3.x requires latest docker) ---
|
|
docker_install: true
|
|
docker_add_admin_to_group: false # IMPORTANT: groupe docker = root-equivalent
|