91 lines
3.6 KiB
YAML
91 lines
3.6 KiB
YAML
# ============================================================
|
|
# Stoat.chat Fedora 44 - variables
|
|
# ============================================================
|
|
# Single source of truth for every tunable used by the stoat role.
|
|
# Override on the command line like:
|
|
# ansible-playbook -i inventory.ini site.yml -e stoat_domain=chat.example.com
|
|
# ============================================================
|
|
|
|
# ------------------------------------------------------------
|
|
# >>> REQUIRED <<<
|
|
# The domain that has an A/AAAA record pointing to this server.
|
|
# Let's Encrypt certificates (via the built-in Caddy) are issued
|
|
# for this name, and every URL Stoat advertises uses it.
|
|
# Example: stoat.example.com (NOT the public stoat.chat domain)
|
|
# ------------------------------------------------------------
|
|
stoat_domain: chat.fpov.space
|
|
|
|
# ------------------------------------------------------------
|
|
# Stoat application
|
|
# ------------------------------------------------------------
|
|
stoat_repo: https://github.com/stoatchat/self-hosted
|
|
stoat_install_dir: /opt/stoat/self-hosted
|
|
stoat_version: main
|
|
|
|
# Place Stoat behind an existing reverse proxy?
|
|
# false (recommended): the built-in Caddy terminates TLS on 80/443
|
|
# true: Caddy is moved to localhost:8880 and you must
|
|
# provide your own front proxy + certificate
|
|
stoat_reverse_proxy: false
|
|
|
|
# Enable camera / screen sharing via LiveKit?
|
|
# Requires firewall ports 7881/tcp and 50000-50100/udp (see below)
|
|
stoat_video: true
|
|
|
|
# ------------------------------------------------------------
|
|
# Podman (runs as root)
|
|
# ------------------------------------------------------------
|
|
podman_packages:
|
|
- podman
|
|
- podman-compose # compose file runner (supports service_healthy conditions)
|
|
- podman-docker # `docker` CLI compatibility, backed by podman
|
|
|
|
# ------------------------------------------------------------
|
|
# Hardening - Fail2Ban
|
|
# ------------------------------------------------------------
|
|
fail2ban_port: "22"
|
|
fail2ban_maxretry: 3 # failed attempts before a ban
|
|
fail2ban_bantime: 3600 # ban length in seconds (1 hour)
|
|
|
|
# ------------------------------------------------------------
|
|
# Hardening - SSH
|
|
# ------------------------------------------------------------
|
|
sshd_permit_root_login: no
|
|
# Keep password login enabled on this server. Fail2Ban (see below)
|
|
# still guards against brute-force attempts.
|
|
sshd_password_authentication: yes
|
|
|
|
# Enable ONLY if a TOTP / WebUI-2FA PAM module is already
|
|
# configured in /etc/pam.d/sshd - otherwise you can lock yourself
|
|
# out. Leave false unless you know what you are doing.
|
|
sshd_mfa_required: false
|
|
|
|
# ------------------------------------------------------------
|
|
# Hardening - SELinux
|
|
# ------------------------------------------------------------
|
|
# Native Fedora 44 ships SELinux enforcing; the role keeps it in
|
|
# this mode and installs container-selinux + policycoreutils
|
|
# (semanage / audit2why) for diagnosing container denials.
|
|
selinux_mode: enforcing
|
|
|
|
# ------------------------------------------------------------
|
|
# Hardening - firewall (firewalld, default deny)
|
|
# ------------------------------------------------------------
|
|
# Services: ssh for administration, http/https for Caddy TLS
|
|
firewall_services:
|
|
- ssh
|
|
- http
|
|
- https
|
|
|
|
# Ports: LiveKit voice/video (signaling tcp + media udp range)
|
|
firewall_ports:
|
|
- "7881/tcp"
|
|
- "50000-50100/udp"
|
|
|
|
# ------------------------------------------------------------
|
|
# Base packages
|
|
# ------------------------------------------------------------
|
|
base_packages:
|
|
- git # clone the stoat repo
|
|
- curl
|
|
- openssl # generate_config.sh secret generation |