# Copy to vpnhub.yml, fill in, then ENCRYPT before committing anything:
#   ansible-vault encrypt group_vars/vpnhub.yml
# (vpnhub.yml is gitignored regardless, belt and braces.)

# ── Domain controllers ──
troch_dc1_ip: 192.168.20.CHANGEME   # AHDC01
troch_dc2_ip: 192.168.20.CHANGEME   # AHDC03
oswald_dc_ip: 192.168.7.CHANGEME    # AH-OSWLDC

# ── WireGuard site peers ──
# Leave empty on the first run: the playbook generates the hub key, prints
# the hub PUBLIC key to add at both sites, and holds off starting wg0.
# Paste each site's public key here and re-run.
troch_wg_public_key: ""
oswald_wg_public_key: ""

# ── Duo (Admin Panel -> Applications -> OpenVPN/RADIUS) ──
duo_ikey: ""
duo_skey: ""
duo_api_host: api-XXXXXXXX.duosecurity.com

# ── AD service account for the Duo Auth Proxy (read-only) ──
duo_svc_user: svc-duoproxy          # sAMAccountName, not UPN
duo_svc_password: ""
ad_search_dn: DC=ad,DC=atlashorizon,DC=net
# Only used if you uncomment security_group_dn in authproxy.cfg.template:
duo_security_group_dn: ""

# ── OpenVPN <-> Duo RADIUS shared secret (openssl rand -hex 24) ──
radius_secret: ""

# ── Technitium web console admin password ──
# Seeded on the FIRST container start only; afterwards change it in the
# console (this var must still match for the init job's API login).
technitium_admin_password: ""

# ── Optional ──
# Pin for deterministic Duo updates (e.g. "6.5.1"); bumping it forces a
# refetch of the tarball on the next rebuild.
duo_authproxy_version: latest
# vpnhub_base_dir: /opt