36 lines
1.5 KiB
YAML
36 lines
1.5 KiB
YAML
---
|
|
# Gemeinsame Variablen. Umgebungsspezifische Werte in
|
|
# jumphost_with_nginx.yml / jumphost_no_nginx.yml ueberschreiben
|
|
# (oder direkt hier anpassen, wenn nur eine Umgebung existiert).
|
|
|
|
jumphost_app_user: jumphost
|
|
jumphost_app_group: jumphost
|
|
jumphost_home: /opt/jumphost
|
|
jumphost_data_dir: /var/lib/jumphost
|
|
jumphost_venv: "{{ jumphost_home }}/venv"
|
|
jumphost_repo_src: "{{ playbook_dir }}/../.." # Projekt-Root (enthaelt app/, static/, templates/)
|
|
|
|
jumphost_listen_uds: /run/jumphost/app.sock
|
|
jumphost_app_port: 8443 # nur relevant wenn enable_nginx_proxy: false
|
|
|
|
guacd_port: 4822
|
|
|
|
# --- nginx / TLS ------------------------------------------------------------
|
|
enable_nginx_proxy: true
|
|
tls_mode: internal_pki # internal_pki | external_reverse_proxy | acme_public
|
|
# Nur fuer tls_mode: external_reverse_proxy relevant:
|
|
external_reverse_proxy_cidr: "10.10.5.0/24"
|
|
internal_hop_plaintext_accepted: false # bewusste Ausnahme, siehe Konzept 7.2a
|
|
# Nur fuer tls_mode: acme_public relevant:
|
|
acme_domain: "jumphost.example.com"
|
|
acme_email: "admin@example.com"
|
|
|
|
# --- Firewall ----------------------------------------------------------------
|
|
ssh_admin_access_cidr: "10.10.1.0/24" # Management-Netz fuer SSH-Zugriff AUF den Jumphost selbst
|
|
target_networks: # Netze der Zielsysteme (fuer ausgehende Regeln)
|
|
- "10.20.0.0/16"
|
|
|
|
# --- Backup --------------------------------------------------------------------
|
|
backup_dir: /var/backups/jumphost
|
|
backup_retention_days: 30
|