next ai changes

ansible/group_vars/vpnhub.example.yml

@@ -0,0 +1,41 @@
+# Copy to vpnhub.yml, fill in, then ENCRYPT before committing anything:
+#   ansible-vault encrypt group_vars/vpnhub.yml
+# (vpnhub.yml is gitignored regardless, belt and braces.)
+
+# ── Domain controllers ──
+troch_dc1_ip: 192.168.20.CHANGEME   # AHDC01
+troch_dc2_ip: 192.168.20.CHANGEME   # AHDC03
+oswald_dc_ip: 192.168.7.CHANGEME    # AH-OSWLDC
+
+# ── WireGuard site peers ──
+# Leave empty on the first run: the playbook generates the hub key, prints
+# the hub PUBLIC key to add at both sites, and holds off starting wg0.
+# Paste each site's public key here and re-run.
+troch_wg_public_key: ""
+oswald_wg_public_key: ""
+
+# ── Duo (Admin Panel -> Applications -> OpenVPN/RADIUS) ──
+duo_ikey: ""
+duo_skey: ""
+duo_api_host: api-XXXXXXXX.duosecurity.com
+
+# ── AD service account for the Duo Auth Proxy (read-only) ──
+duo_svc_user: svc-duoproxy          # sAMAccountName, not UPN
+duo_svc_password: ""
+ad_search_dn: DC=ad,DC=atlashorizon,DC=net
+# Only used if you uncomment security_group_dn in authproxy.cfg.template:
+duo_security_group_dn: ""
+
+# ── OpenVPN <-> Duo RADIUS shared secret (openssl rand -hex 24) ──
+radius_secret: ""
+
+# ── Technitium web console admin password ──
+# Seeded on the FIRST container start only; afterwards change it in the
+# console (this var must still match for the init job's API login).
+technitium_admin_password: ""
+
+# ── Optional ──
+# Pin for deterministic Duo updates (e.g. "6.5.1"); bumping it forces a
+# refetch of the tarball on the next rebuild.
+duo_authproxy_version: latest
+# vpnhub_base_dir: /opt