---
# Variables de construction du golden template Debian 13 Proxmox.

sudo_ansible_admin_user: "ansible"

# SSH : cloud-init doit avoir injecté ciuser et clé publique avant Ansible.
ssh_baseline_password_authentication: "no"
ssh_baseline_permit_root_login: "no"
ssh_baseline_pubkey_authentication: "yes"

ssh_hardening_port: 22
ssh_hardening_password_authentication: "no"
ssh_hardening_permit_root_login: "no"
ssh_hardening_pubkey_authentication: "yes"
ssh_hardening_client_alive_interval: 300
ssh_hardening_client_alive_count_max: 2
ssh_hardening_max_auth_tries: 3
ssh_hardening_login_grace_time: "20s"

systemd_ssh_auto_disable: true

cloud_init_ssh_pwauth: false
cloud_init_manage_etc_hosts: true
cloud_init_disable_root: true
cloud_init_ssh_deletekeys: true

# Pare-feu : préparé mais non activé dans le template.
nftables_baseline_enabled: false
nftables_baseline_allow_ssh: true
nftables_baseline_allow_icmp: true
nftables_baseline_ssh_port: 22
nftables_baseline_input_policy: "drop"
nftables_baseline_forward_policy: "drop"
nftables_baseline_output_policy: "accept"
nftables_baseline_extra_tcp_ports: []
nftables_baseline_extra_udp_ports: []

fail2ban_ssh_enabled: true
fail2ban_ssh_port: 22
fail2ban_ssh_bantime: "1h"
fail2ban_ssh_findtime: "10m"
fail2ban_ssh_maxretry: 5

auditd_enabled: true
apparmor_enabled: true
sysctl_hardening_apply: true
core_dumps_disable: true

unattended_upgrades_enabled: true
unattended_upgrades_remove_unused_dependencies: true
unattended_upgrades_automatic_reboot: false

journald_system_max_use: "200M"
journald_runtime_max_use: "100M"
journald_max_retention_sec: "1month"

template_cleanup_confirm: false
template_cleanup_admin_user: "ansible"