---
chezlepro_timezone: "America/Toronto"
chezlepro_admin_user: "ansible"

# SSH pendant la construction du template.
# Passer à "no" seulement après validation des clés SSH.
chezlepro_ssh_port: 22
chezlepro_ssh_password_authentication: "yes"
chezlepro_ssh_permit_root_login: "no"
chezlepro_ssh_pubkey_authentication: "yes"
chezlepro_ssh_client_alive_interval: 300
chezlepro_ssh_client_alive_count_max: 2
chezlepro_ssh_max_auth_tries: 4
chezlepro_ssh_login_grace_time: "30s"

# systemd-ssh-generator / VSOCK
chezlepro_disable_systemd_ssh_auto: true

# Cloud-init
cloud_init_ssh_pwauth: true
cloud_init_manage_etc_hosts: true
cloud_init_disable_root: true
cloud_init_ssh_deletekeys: true

# Pare-feu : préparé mais non activé dans le template.
chezlepro_nftables_enabled: false
chezlepro_firewall_allow_ssh: true
chezlepro_firewall_allow_icmp: true
chezlepro_firewall_input_policy: "drop"
chezlepro_firewall_forward_policy: "drop"
chezlepro_firewall_output_policy: "accept"
chezlepro_firewall_extra_tcp_ports: []
chezlepro_firewall_extra_udp_ports: []

# Fail2ban
chezlepro_fail2ban_enabled: true
chezlepro_fail2ban_bantime: "1h"
chezlepro_fail2ban_findtime: "10m"
chezlepro_fail2ban_maxretry: 5

# Sécurité
chezlepro_auditd_enabled: true
chezlepro_apparmor_enabled: true
chezlepro_sysctl_apply: true
chezlepro_disable_core_dumps: true

# Unattended upgrades
chezlepro_unattended_upgrades_enabled: true
chezlepro_unattended_remove_unused_dependencies: true
chezlepro_unattended_automatic_reboot: false

# Journald
chezlepro_journald_system_max_use: "200M"
chezlepro_journald_runtime_max_use: "100M"
chezlepro_journald_max_retention_sec: "1month"

# Nettoyage final
confirm_template_cleanup: false

chezlepro_common_packages:
  - sudo
  - openssh-server
  - qemu-guest-agent
  - cloud-init
  - cloud-guest-utils
  - python3
  - python3-apt
  - python3-pip
  - acl
  - curl
  - wget
  - ca-certificates
  - gnupg
  - git
  - vim
  - nano
  - bash-completion
  - tmux
  - rsync
  - unzip
  - zip
  - tar
  - jq
  - htop
  - iotop
  - iftop
  - sysstat
  - lsof
  - ncdu
  - tree
  - file
  - less
  - dnsutils
  - iproute2
  - iputils-ping
  - net-tools
  - traceroute
  - mtr-tiny
  - tcpdump
  - netcat-openbsd
  - socat
  - chrony
  - logrotate
  - unattended-upgrades
  - apt-listchanges
  - needrestart

chezlepro_hardening_packages:
  - apparmor
  - apparmor-utils
  - auditd
  - audispd-plugins
  - fail2ban
  - nftables
  - unattended-upgrades
  - apt-listchanges
  - debsums
  - needrestart
  - libpam-pwquality