---
# Gemeinsame Variablen. Umgebungsspezifische Werte in
# jumphost_with_nginx.yml / jumphost_no_nginx.yml ueberschreiben
# (oder direkt hier anpassen, wenn nur eine Umgebung existiert).

jumphost_app_user: jumphost
jumphost_app_group: jumphost
jumphost_home: /opt/jumphost
jumphost_data_dir: /var/lib/jumphost
jumphost_venv: "{{ jumphost_home }}/venv"
jumphost_repo_src: "{{ playbook_dir }}/../.."   # Projekt-Root (enthaelt app/, static/, templates/)

jumphost_listen_uds: /run/jumphost/app.sock
jumphost_app_port: 8443          # nur relevant wenn enable_nginx_proxy: false

guacd_port: 4822

# --- nginx / TLS ------------------------------------------------------------
enable_nginx_proxy: true
tls_mode: internal_pki           # internal_pki | external_reverse_proxy | acme_public
# Nur fuer tls_mode: external_reverse_proxy relevant:
external_reverse_proxy_cidr: "10.10.5.0/24"
internal_hop_plaintext_accepted: false   # bewusste Ausnahme, siehe Konzept 7.2a
# Nur fuer tls_mode: acme_public relevant:
acme_domain: "jumphost.example.com"
acme_email: "admin@example.com"

# --- Firewall ----------------------------------------------------------------
ssh_admin_access_cidr: "10.10.1.0/24"   # Management-Netz fuer SSH-Zugriff AUF den Jumphost selbst
target_networks:                          # Netze der Zielsysteme (fuer ausgehende Regeln)
  - "10.20.0.0/16"

# --- Backup --------------------------------------------------------------------
backup_dir: /var/backups/jumphost
backup_retention_days: 30