second commit

ansible/inventory/group_vars/all.yml

@@ -0,0 +1,35 @@
+---
+# Gemeinsame Variablen. Umgebungsspezifische Werte in
+# jumphost_with_nginx.yml / jumphost_no_nginx.yml ueberschreiben
+# (oder direkt hier anpassen, wenn nur eine Umgebung existiert).
+
+jumphost_app_user: jumphost
+jumphost_app_group: jumphost
+jumphost_home: /opt/jumphost
+jumphost_data_dir: /var/lib/jumphost
+jumphost_venv: "{{ jumphost_home }}/venv"
+jumphost_repo_src: "{{ playbook_dir }}/../.."   # Projekt-Root (enthaelt app/, static/, templates/)
+
+jumphost_listen_uds: /run/jumphost/app.sock
+jumphost_app_port: 8443          # nur relevant wenn enable_nginx_proxy: false
+
+guacd_port: 4822
+
+# --- nginx / TLS ------------------------------------------------------------
+enable_nginx_proxy: true
+tls_mode: internal_pki           # internal_pki | external_reverse_proxy | acme_public
+# Nur fuer tls_mode: external_reverse_proxy relevant:
+external_reverse_proxy_cidr: "10.10.5.0/24"
+internal_hop_plaintext_accepted: false   # bewusste Ausnahme, siehe Konzept 7.2a
+# Nur fuer tls_mode: acme_public relevant:
+acme_domain: "jumphost.example.com"
+acme_email: "admin@example.com"
+
+# --- Firewall ----------------------------------------------------------------
+ssh_admin_access_cidr: "10.10.1.0/24"   # Management-Netz fuer SSH-Zugriff AUF den Jumphost selbst
+target_networks:                          # Netze der Zielsysteme (fuer ausgehende Regeln)
+  - "10.20.0.0/16"
+
+# --- Backup --------------------------------------------------------------------
+backup_dir: /var/backups/jumphost
+backup_retention_days: 30