119 lines
2.5 KiB
YAML
119 lines
2.5 KiB
YAML
---
|
|
chezlepro_timezone: "America/Toronto"
|
|
chezlepro_admin_user: "ansible"
|
|
|
|
# SSH pendant la construction du template.
|
|
# Passer à "no" seulement après validation des clés SSH.
|
|
chezlepro_ssh_port: 22
|
|
chezlepro_ssh_password_authentication: "yes"
|
|
chezlepro_ssh_permit_root_login: "no"
|
|
chezlepro_ssh_pubkey_authentication: "yes"
|
|
chezlepro_ssh_client_alive_interval: 300
|
|
chezlepro_ssh_client_alive_count_max: 2
|
|
chezlepro_ssh_max_auth_tries: 4
|
|
chezlepro_ssh_login_grace_time: "30s"
|
|
|
|
# systemd-ssh-generator / VSOCK
|
|
chezlepro_disable_systemd_ssh_auto: true
|
|
|
|
# Cloud-init
|
|
cloud_init_ssh_pwauth: true
|
|
cloud_init_manage_etc_hosts: true
|
|
cloud_init_disable_root: true
|
|
cloud_init_ssh_deletekeys: true
|
|
|
|
# Pare-feu : préparé mais non activé dans le template.
|
|
chezlepro_nftables_enabled: false
|
|
chezlepro_firewall_allow_ssh: true
|
|
chezlepro_firewall_allow_icmp: true
|
|
chezlepro_firewall_input_policy: "drop"
|
|
chezlepro_firewall_forward_policy: "drop"
|
|
chezlepro_firewall_output_policy: "accept"
|
|
chezlepro_firewall_extra_tcp_ports: []
|
|
chezlepro_firewall_extra_udp_ports: []
|
|
|
|
# Fail2ban
|
|
chezlepro_fail2ban_enabled: true
|
|
chezlepro_fail2ban_bantime: "1h"
|
|
chezlepro_fail2ban_findtime: "10m"
|
|
chezlepro_fail2ban_maxretry: 5
|
|
|
|
# Sécurité
|
|
chezlepro_auditd_enabled: true
|
|
chezlepro_apparmor_enabled: true
|
|
chezlepro_sysctl_apply: true
|
|
chezlepro_disable_core_dumps: true
|
|
|
|
# Unattended upgrades
|
|
chezlepro_unattended_upgrades_enabled: true
|
|
chezlepro_unattended_remove_unused_dependencies: true
|
|
chezlepro_unattended_automatic_reboot: false
|
|
|
|
# Journald
|
|
chezlepro_journald_system_max_use: "200M"
|
|
chezlepro_journald_runtime_max_use: "100M"
|
|
chezlepro_journald_max_retention_sec: "1month"
|
|
|
|
# Nettoyage final
|
|
confirm_template_cleanup: false
|
|
|
|
chezlepro_common_packages:
|
|
- sudo
|
|
- openssh-server
|
|
- qemu-guest-agent
|
|
- cloud-init
|
|
- cloud-guest-utils
|
|
- python3
|
|
- python3-apt
|
|
- python3-pip
|
|
- acl
|
|
- curl
|
|
- wget
|
|
- ca-certificates
|
|
- gnupg
|
|
- git
|
|
- vim
|
|
- nano
|
|
- bash-completion
|
|
- tmux
|
|
- rsync
|
|
- unzip
|
|
- zip
|
|
- tar
|
|
- jq
|
|
- htop
|
|
- iotop
|
|
- iftop
|
|
- sysstat
|
|
- lsof
|
|
- ncdu
|
|
- tree
|
|
- file
|
|
- less
|
|
- dnsutils
|
|
- iproute2
|
|
- iputils-ping
|
|
- net-tools
|
|
- traceroute
|
|
- mtr-tiny
|
|
- tcpdump
|
|
- netcat-openbsd
|
|
- socat
|
|
- chrony
|
|
- logrotate
|
|
- unattended-upgrades
|
|
- apt-listchanges
|
|
- needrestart
|
|
|
|
chezlepro_hardening_packages:
|
|
- apparmor
|
|
- apparmor-utils
|
|
- auditd
|
|
- audispd-plugins
|
|
- fail2ban
|
|
- nftables
|
|
- unattended-upgrades
|
|
- apt-listchanges
|
|
- debsums
|
|
- needrestart
|
|
- libpam-pwquality
|