hostname: vh-01.lab.alexpires.me
ansible_user: "{{ lookup('env', 'ANSIBLE_USER') }}"

packages_blocklist:
  - apport*
  - autofs
  - beep
  - git
  - pastebinit
  - popularity-contest
  - prelink
  - rpcbind
  - rsh*
  - talk*
  - telnet*
  - tftp*
  - whoopsie
  - xinetd
  - yp-tools
  - ypbind

misc_modules_blocklist:
  - bluetooth
  - bnep
  - btusb
  - can
  - cpia2
  - firewire-core
  - floppy
  - ksmbd
  - n_hdlc
  - net-pf-31
  - pcspkr
  - soundcore
  - usb-midi
  - uvcvideo
  - v4l2_common

# Users
login_users:
  - username: "{{ ansible_user }}"
    comment: "Managed by Ansible"
    sudoer: true
    sudoer_root_only: true
    sudoer_no_password: true
    pubkey: "{{ lookup('file', 'keys/ansible_user.pub') }}"
    password_disabled: true
  - username: operator
    comment: "Managed by Ansible"
    sudoer: true
    pubkey: "{{ lookup('file', 'keys/operator.pub') }}"
    shell: "/bin/zsh"
    password_expiration: false

# SSH Connection and security
sshd_port: 22
ssh_allowed_networks:
  - "10.5.5.5/32" # Wireguard VPN (Laptop)
  - "10.19.4.0/24" # local network
sshd_admin_net: "10.19.4.0/24" # local network
sshd_allow_groups: "{{ ansible_user }} users"
sshd_permit_root_login: "no"
sshd_password_authentication: "no"
sshd_allow_tcp_forwarding: "yes"

# Due to an issue increase the number of max auth tries
sshd_max_auth_tries: 10

# Firewall ports
ufw_enable: true
fw_allowed_ports:
  - { rule: "allow", port: "22", proto: "tcp", from: "10.5.5.5/32" } # Wireguard VPN (Laptop)
  - { rule: "allow", port: "22", proto: "tcp", from: "10.19.4.0/24" } # local network
  - { rule: "allow", port: "9090", proto: "tcp", from: "10.19.4.0/24" } # local network

ufw_outgoing_traffic:
  - 22 # SSH
  - 53 # DNS
  - 80 # HTTP
  - 123 # NTP
  - 443 # HTTPS
  - 853 # DNS over TLS

ufw_default_forward_policy: "ACCEPT"

ipv4_sysctl_settings:
  net.ipv4.ip_forward: 1

disable_ipv6: true

# Network Bridge Configuration
bridge_name: "br0"
bridge_interface: "{{ ansible_default_ipv4.interface }}" # Auto-detect primary interface
bridge_ipv4_address: "10.19.4.254/24" # Adjust to your static IP
bridge_ipv4_gateway: "10.19.4.1"
bridge_ipv4_dns: "10.19.4.1,1.1.1.1"
bridge_ipv4_domain: "lab.alexpires.me"

# geoip will override hosts_allow and hosts_deny (so it's disabled - CIS hardening)
custom_hosts_acls: true

# This fixes polkit issues with sudoers file (CIS hardening)
hide_pid: 0

# aide
install_aide: false

# Unattended upgrades
unattended_reboot: false
unattended_reboot_time: "04:30"

# Duo Security
duo_users: ["*", "!provision"]
duo_api_hostname: api-7cda1654.duosecurity.com

# VMs reserved CPU )
virt_vm_reserved_cpu: "1-7,9-15"
virt_raw_block_devices: []

# Devices to unbind for VFIO passthrough (This are devices that will be unbound at boot with vfio-bind.sh)
virt_vfio_devices:
  - { dev: "0000:08:00.0", vendor: "1b73", device: "1100" } # Fresco Logic FL1100 USB 3.0 Host Controller
  - { dev: "0000:05:00.0", vendor: "c0a9", device: "5415" } # Micron/Crucial Technology T500 NVMe PCIe SSD

virt_extra_grub_args: >
  rd.driver.blacklist=nouveau modprobe.blacklist=nouveau ipv6.disable=1 audit=1 audit_backlog_limit=8192 usbcore.autosuspend=-1

virt_vfio_ids:
  - 10de:1430 # NVIDIA Corporation M2000 [Maxwell GM107GL]
  - 10de:0fba # NVIDIA Corporation M2000 High Definition Audio Controller
  - 1b73:1100 # Fresco Logic FL1100 USB 3.0 Host Controller
  - c0a9:5415 # Micron/Crucial Technology T500 NVMe PCIe SSD

virt_blacklist:
  - noveau
  - snd_hda_codec_hdmi
  - i2c_nvidia_gpu
  - mxm_wmi

virt_machines:
  - name: win10pro
    title: "Microsoft Windows 10 Pro"
    uuid: "51d5d091-67cb-4113-bd8e-817e7317e1b4"
    autostart: false
    memory: 16
    cores: 5
    threads: 2
    physical_cpus: "3-11,4-12,5-13,6-14,7-15"
    reserved_cpus: "0,8"
    enable_hyperv: true
    cdrom: true
    console: false
    audio: true
    secure_boot: true
    tpm: true
    tablet: true
    net_bridge: br0
    disk_file: "win10pro.qcow2"
    mac_address: "52:54:00:cd:dd:2d"
    block_devs: []
    guest_agent: true
    virtio_fs:
      - source: "/mnt/usb"
        target: "usb"
    host_devs:
      # Micron/Crucial Technology T500 NVMe PCIe SSD
      - type: "pci"
        source:
          address:
            domain: "0x0000"
            bus: "0x05"
            slot: "0x00"
            function: "0x0"
        address:
          type: "pci"
          domain: "0x0000"
          bus: "0x11"
          slot: "0x00"
          function: "0x0"
      # Fresco Logic FL1100 USB 3.0 Host Controller
      - type: "pci"
        source:
          address:
            domain: "0x0000"
            bus: "0x08"
            slot: "0x00"
            function: "0x0"
        address:
          type: "pci"
          domain: "0x0000"
          bus: "0x10"
          slot: "0x00"
          function: "0x0"
      # NVIDIA Corporation M2000 [Maxwell GM107GL]
      - type: "pci"
        source:
          address:
            domain: "0x0000"
            bus: "0x03"
            slot: "0x00"
            function: "0x0"
        address:
          type: "pci"
          domain: "0x0000"
          bus: "0x0b"
          slot: "0x00"
          function: "0x0"
      # NVIDIA Corporation M2000 High Definition Audio Controller
      - type: "pci"
        source:
          address:
            domain: "0x0000"
            bus: "0x03"
            slot: "0x00"
            function: "0x1"
        address:
          type: "pci"
          domain: "0x0000"
          bus: "0x0f"
          slot: "0x00"
          function: "0x0"

  - name: win11home
    title: "Microsoft Windows 11 Home"
    uuid: "51d5d091-67cb-4113-bd8e-817e7317e1b5"
    autostart: false
    memory: 16
    cores: 5
    threads: 2
    physical_cpus: "3-11,4-12,5-13,6-14,7-15"
    reserved_cpus: "0,8"
    enable_hyperv: true
    cdrom: true
    console: false
    audio: true
    secure_boot: true
    tpm: true
    tablet: true
    net_bridge: br0
    disk_file: "win11home.qcow2"
    mac_address: "52:54:00:cd:dd:2e"
    block_devs: []
    guest_agent: true
    virtio_fs:
      - source: "/mnt/usb"
        target: "usb"
    host_devs:
      # Micron/Crucial Technology T500 NVMe PCIe SSD
      - type: "pci"
        source:
          address:
            domain: "0x0000"
            bus: "0x05"
            slot: "0x00"
            function: "0x0"
        address:
          type: "pci"
          domain: "0x0000"
          bus: "0x11"
          slot: "0x00"
          function: "0x0"
      # Fresco Logic FL1100 USB 3.0 Host Controller
      - type: "pci"
        source:
          address:
            domain: "0x0000"
            bus: "0x08"
            slot: "0x00"
            function: "0x0"
        address:
          type: "pci"
          domain: "0x0000"
          bus: "0x10"
          slot: "0x00"
          function: "0x0"
      # NVIDIA Corporation M2000 [Maxwell GM107GL]
      - type: "pci"
        source:
          address:
            domain: "0x0000"
            bus: "0x03"
            slot: "0x00"
            function: "0x0"
        address:
          type: "pci"
          domain: "0x0000"
          bus: "0x0b"
          slot: "0x00"
          function: "0x0"
      # NVIDIA Corporation M2000 High Definition Audio Controller
      - type: "pci"
        source:
          address:
            domain: "0x0000"
            bus: "0x03"
            slot: "0x00"
            function: "0x1"
        address:
          type: "pci"
          domain: "0x0000"
          bus: "0x0f"
          slot: "0x00"
          function: "0x0"

  - name: dev-01
    title: "Lab Kubernetes VM"
    uuid: "55feda16-51ae-446e-9c83-4c0eee1e5e00"
    cloud_image_url: "http://cloud-images.ubuntu.com/noble/current/noble-server-cloudimg-amd64.img"
    cloud_image_sha256: "2b5f90ffe8180def601c021c874e55d8303e8bcbfc66fee2b94414f43ac5eb1f"
    disk_size: 80G
    cloud_init: true
    autostart: true
    memory: 8
    cores: 1
    threads: 2
    physical_cpus: "2-10"
    reserved_cpus: "0,8"
    cdrom: true
    console: true
    audio: false
    secure_boot: true
    tpm: true
    net_bridge: br0
    disk_file: "dev-01.qcow2"
    mac_address: "52:54:00:ae:f3:d0"
    block_devs: []
    host_devs: []
    guest_agent: true
    virtio_fs:
      - source: "/mnt/srv"
        target: "srv"
      - source: "/mnt/md0"
        target: "md0"
    user_data: |
      #cloud-config
      hostname: dev-01
      fqdn: dev-01.lab.alexpires.me
      manage_etc_hosts: true
      users:
        - name: provision
          sudo: ALL=(ALL) NOPASSWD:ALL
          shell: /bin/bash
          lock_passwd: true
          ssh_authorized_keys:
            - {{ lookup('file', 'keys/localnetwork.pub') | trim }}
      ssh_pwauth: false
      disable_root: true
      package_upgrade: true
      packages:
        - qemu-guest-agent
      runcmd:
        - systemctl enable qemu-guest-agent
        - systemctl start qemu-guest-agent

# Let's Encrypt / Certbot
cloudns_auth_id: "{{ lookup('env', 'CLOUDNS_AUTH_ID') }}"
cloudns_auth_password: "{{ lookup('env', 'CLOUDNS_PASSWORD') }}"
cloudns_nameserver: "109.201.133.111"
certbot_email: c.alexandre.pires@alexpires.me
certbot_domains:
  - "vh-01.lab.alexpires.me"
certbot_cockpit_domain: "vh-01.lab.alexpires.me"