## add generic 755 directory for application here
directories:
  - /opt/apps/npm
  - /opt/apps/jellyfin
  - /opt/apps/letsencrypt
  - /opt/apps/gitea
  - /opt/apps/jellyfin/config
  - /opt/apps/n8n/data
  - /opt/apps/prowler/data
  - /opt/apps/prowler/tmp/prowler_api_output
  - /opt/apps/prowler/postgres/data
  - /opt/apps/wireguard
  - /opt/apps/wazuh/config
  - /opt/apps/wazuh/config/wazuh_indexer_ssl_certs
  - /opt/apps/wazuh/config/wazuh_cluster
  - /opt/apps/wazuh/config/wazuh_dashboard
  - /opt/apps/wazuh/config/wazuh_indexer
  - /opt/apps/minecraft
  - /opt/apps/minecraft/data
  - /opt/apps/zomboid
  - /opt/apps/zomboid/data


## Jellyfin directories for media
directories_jellyfin:
  - /opt/apps/jellyfin/tvseries
  - /opt/apps/jellyfin/movies

images:
  - docker.io/jc21/nginx-proxy-manager:latest
  - lscr.io/linuxserver/jellyfin:latest
  - docker.gitea.com/gitea:nightly
  - docker.io/wazuh/wazuh-certs-generator:0.0.3
  - ghcr.io/wg-easy/wg-easy:15
  - docker.io/wazuh/wazuh-dashboard:{{ wazuh_version }}
  - docker.io/wazuh/wazuh-indexer:{{ wazuh_version }}
  - docker.io/wazuh/wazuh-manager:{{ wazuh_version }}
  - docker.io/itzg/minecraft-server:latest
  - docker.io/danixu86/project-zomboid-dedicated-server:latest


wazuh_version: 4.14.1
sudo_password: sdfwwww

POSTGRES_ADMIN_USER: theuseriwant
POSTGRES_PASSWORD: theuserthatineedpaswoord
POSTGRES_DB: thatoneit

## WireGuard Easy VPN
## IMPORTANT: After first run, change wireguard_ui_password to a strong password
## Public IP or DDNS hostname clients connect to — CHANGE THIS before deploying
wireguard_image: ghcr.io/wg-easy/wg-easy:15
wireguard_host: vpn.boxswapper.io
wireguard_ui_username: admin
wireguard_ui_password: T3l0penF@5tback
wireguard_port: 51820
wireguard_ui_port: 51821
wireguard_cidr: 10.10.1.0/24
wireguard_ipv6_cidr: fd00:10:10::/64
wireguard_allowed_ips: 10.10.1.0/24,10.10.0.0/24
wireguard_default_dns: 1.1.1.1
wireguard_ip: 10.10.0.36

## Wazuh SIEM (static IPs on npm_internal)
wazuh_dashboard_ip: 10.10.0.40
wazuh_manager_ip: 10.10.0.41
wazuh_indexer_ip: 10.10.0.42

## Wazuh agent (installed on this host by packages role)
## Server address the agent reports to (manager reachable on ports 1514/1515 via router forwarding)
wazuh_agent_rpm: wazuh-agent-4.14.1-1.x86_64.rpm
wazuh_server_address: wazuh.boxswapper.io

## Minecraft server (Java + Bedrock crossplay via Geyser/Floodgate)
## External DNS (not managed here): Cloudflare A record mc.boxswapper.io -> public IP (grey-cloud,
## same as vpn.boxswapper.io / wazuh.boxswapper.io). Router MUST forward TCP 25565 + UDP 19132 -> 10.10.0.45.
minecraft_host: mc.boxswapper.io
minecraft_ip: 10.10.0.45
minecraft_version: latest
minecraft_memory: 8G
minecraft_motd: "Welcome Retards"
minecraft_difficulty: normal
minecraft_gamemode: survival
minecraft_max_players: 20
minecraft_view_distance: 10
minecraft_online_mode: "TRUE"
minecraft_plugins:
  - https://download.geysermc.org/v2/projects/geyser/versions/latest/builds/latest/downloads/spigot
  - https://download.geysermc.org/v2/projects/floodgate/versions/latest/builds/latest/downloads/spigot

## Project Zomboid dedicated server (danixu86 container, SteamCMD-based, B42-ready)
## PRIVATE server: not shown in the in-game server browser (zomboid_public: false) — friends must
## direct-connect to zomboid.boxswapper.io:16261 and enter the join password (zomboid_password) once.
## External DNS (not managed here): Cloudflare A record zomboid.boxswapper.io -> public IP (grey-cloud,
## same as mc.boxswapper.io / vpn.boxswapper.io). Router MUST forward UDP 16261-16276 + TCP 27015 (RCON)
## -> 10.10.0.46. Server ini is rendered from roles/zomboid/templates/zomboid.ini.j2 on deploy; the
## published UDP range (16261-16276) covers zomboid_max_players=16 (game 16261 + query 16262 + per-slot ports).
## PUBLIC mode (zomboid_public: "true") also requires router forwards UDP 8766-8767 (Steam query) and
## publishes them; PRIVATE mode (the original design) needs only 16261-16276 — clients direct-connect
## (server browser never lists private servers).
zomboid_host: zomboid.boxswapper.io
zomboid_ip: 10.10.0.46
zomboid_image: docker.io/danixu86/project-zomboid-dedicated-server:latest
## SERVERNAME becomes the config folder/file name — must NOT contain spaces or special characters.
zomboid_servername: Boxswapper
zomboid_displayname: "Boxswapper Zomboid Server"
zomboid_admin_username: admin
## CHANGE THESE before first deploy — ADMINPASSWORD is mandatory on first startup (server fails to boot without it),
## RCONPASSWORD gates the 27015/tcp admin console, and zomboid_password is the join password players must enter
## when connecting (leave empty to allow password-less joins).
zomboid_admin_password: 9QmvIhCPOUcWeV9W
zomboid_rcon_password: lnaScHaCnB2z8k7D
zomboid_password: DOvNml9VCyeXlJx2
zomboid_public: "true"
## Server ini is rendered from roles/zomboid/templates/zomboid.ini.j2 on every deploy —
## vars.yml is the source of truth for the ini, so edits to these vars re-apply on re-run.
## MaxPlayers must fit the published/forwarded UDP range (16261-16276 = 16 slots); raise the range
## in the role and router forwards if you bump it.
zomboid_max_players: 16
zomboid_pvp: "true"
zomboid_pause_empty: "true"
## "true" makes the container re-verify the full 7.2GB Steam install on EVERY start (slow boots).
## Leave "false" for fast boots; flip to "true" when a new PZ build drops and re-run once.
zomboid_force_update: "false"
zomboid_memory: 8g
zomboid_preset: Apocalypse