# ============================================================
# Stoat.chat Fedora 44 - variables
# ============================================================
# Single source of truth for every tunable used by the stoat role.
# Override on the command line like:
#   ansible-playbook -i inventory.ini site.yml -e stoat_domain=chat.example.com
# ============================================================

# ------------------------------------------------------------
# >>> REQUIRED <<<
# The domain that has an A/AAAA record pointing to this server.
# Let's Encrypt certificates (via the built-in Caddy) are issued
# for this name, and every URL Stoat advertises uses it.
# Example: stoat.example.com  (NOT the public stoat.chat domain)
# ------------------------------------------------------------
stoat_domain: chat.fpov.space

# ------------------------------------------------------------
# Stoat application
# ------------------------------------------------------------
stoat_repo: https://github.com/stoatchat/self-hosted
stoat_install_dir: /opt/stoat/self-hosted
stoat_version: main

# Place Stoat behind an existing reverse proxy?
# false (recommended): the built-in Caddy terminates TLS on 80/443
# true:               Caddy is moved to localhost:8880 and you must
#                     provide your own front proxy + certificate
stoat_reverse_proxy: false

# Enable camera / screen sharing via LiveKit?
# Requires firewall ports 7881/tcp and 50000-50100/udp (see below)
stoat_video: true

# ------------------------------------------------------------
# Podman (runs as root)
# ------------------------------------------------------------
podman_packages:
  - podman
  - podman-compose          # compose file runner (supports service_healthy conditions)
  - podman-docker           # `docker` CLI compatibility, backed by podman

# ------------------------------------------------------------
# Hardening - Fail2Ban
# ------------------------------------------------------------
fail2ban_port: "22"
fail2ban_maxretry: 3        # failed attempts before a ban
fail2ban_bantime: 3600      # ban length in seconds (1 hour)

# ------------------------------------------------------------
# Hardening - SSH
# ------------------------------------------------------------
sshd_permit_root_login: no
# Keep password login enabled on this server. Fail2Ban (see below)
# still guards against brute-force attempts.
sshd_password_authentication: yes

# Enable ONLY if a TOTP / WebUI-2FA PAM module is already
# configured in /etc/pam.d/sshd - otherwise you can lock yourself
# out. Leave false unless you know what you are doing.
sshd_mfa_required: false

# ------------------------------------------------------------
# Hardening - SELinux
# ------------------------------------------------------------
# Native Fedora 44 ships SELinux enforcing; the role keeps it in
# this mode and installs container-selinux + policycoreutils
# (semanage / audit2why) for diagnosing container denials.
selinux_mode: enforcing

# ------------------------------------------------------------
# Hardening - firewall (firewalld, default deny)
# ------------------------------------------------------------
# Services: ssh for administration, http/https for Caddy TLS
firewall_services:
  - ssh
  - http
  - https

# Ports: LiveKit voice/video (signaling tcp + media udp range)
firewall_ports:
  - "7881/tcp"
  - "50000-50100/udp"

# ------------------------------------------------------------
# Base packages
# ------------------------------------------------------------
base_packages:
  - git          # clone the stoat repo
  - curl
  - openssl      # generate_config.sh secret generation