initial commit

group_vars/all/vars.yml

@@ -0,0 +1,88 @@
+# ============================================================
+# Stoat.chat Fedora 44 - variables
+# ============================================================
+# Single source of truth for every tunable used by the stoat role.
+# Override on the command line like:
+#   ansible-playbook -i inventory.ini site.yml -e stoat_domain=chat.example.com
+# ============================================================
+
+# ------------------------------------------------------------
+# >>> REQUIRED <<<
+# The domain that has an A/AAAA record pointing to this server.
+# Let's Encrypt certificates (via the built-in Caddy) are issued
+# for this name, and every URL Stoat advertises uses it.
+# Example: stoat.example.com  (NOT the public stoat.chat domain)
+# ------------------------------------------------------------
+stoat_domain: chat.example.com
+
+# ------------------------------------------------------------
+# Stoat application
+# ------------------------------------------------------------
+stoat_repo: https://github.com/stoatchat/self-hosted
+stoat_install_dir: /opt/stoat/self-hosted
+stoat_version: main
+
+# Place Stoat behind an existing reverse proxy?
+# false (recommended): the built-in Caddy terminates TLS on 80/443
+# true:               Caddy is moved to localhost:8880 and you must
+#                     provide your own front proxy + certificate
+stoat_reverse_proxy: false
+
+# Enable camera / screen sharing via LiveKit?
+# Requires firewall ports 7881/tcp and 50000-50100/udp (see below)
+stoat_video: true
+
+# ------------------------------------------------------------
+# Podman (rootless)
+# ------------------------------------------------------------
+# Unprivileged system user that runs the rootless podman stack
+stoat_service_user: stoat
+
+podman_packages:
+  - podman
+  - podman-compose          # compose file runner (supports service_healthy conditions)
+  - podman-docker           # `docker` CLI compatibility, backed by podman
+
+# Rootless containers cannot bind ports < 1024 by default.
+# Caddy needs 80/443, so lower the unprivileged port floor.
+podman_unprivileged_port_start: 80
+
+# ------------------------------------------------------------
+# Hardening - Fail2Ban
+# ------------------------------------------------------------
+fail2ban_port: "22"
+fail2ban_maxretry: 3        # failed attempts before a ban
+fail2ban_bantime: 3600      # ban length in seconds (1 hour)
+
+# ------------------------------------------------------------
+# Hardening - SSH
+# ------------------------------------------------------------
+sshd_permit_root_login: no
+sshd_password_authentication: no
+
+# Enable ONLY if a TOTP / WebUI-2FA PAM module is already
+# configured in /etc/pam.d/sshd - otherwise you can lock yourself
+# out. Leave false unless you know what you are doing.
+sshd_mfa_required: false
+
+# ------------------------------------------------------------
+# Hardening - firewall (firewalld, default deny)
+# ------------------------------------------------------------
+# Services: ssh for administration, http/https for Caddy TLS
+firewall_services:
+  - ssh
+  - http
+  - https
+
+# Ports: LiveKit voice/video (signaling tcp + media udp range)
+firewall_ports:
+  - "7881/tcp"
+  - "50000-50100/udp"
+
+# ------------------------------------------------------------
+# Base packages
+# ------------------------------------------------------------
+base_packages:
+  - git          # clone the stoat repo
+  - curl
+  - openssl      # generate_config.sh secret generation