47 lines
1.8 KiB
YAML
47 lines
1.8 KiB
YAML
# Copy to vpnhub.yml, fill in, then ENCRYPT before committing anything:
|
|
# ansible-vault encrypt group_vars/vpnhub.yml
|
|
# (vpnhub.yml is gitignored regardless, belt and braces.)
|
|
|
|
# ── Domain controllers ──
|
|
troch_dc1_ip: 192.168.20.CHANGEME # AHDC01
|
|
troch_dc2_ip: 192.168.20.CHANGEME # AHDC03
|
|
oswald_dc_ip: 192.168.7.CHANGEME # AH-OSWLDC
|
|
|
|
# ── WireGuard site peers ──
|
|
# Leave empty on the first run: the playbook generates the hub key, prints
|
|
# the hub PUBLIC key to add at both sites, and holds off starting wg0.
|
|
# Paste each site's public key here and re-run.
|
|
troch_wg_public_key: ""
|
|
oswald_wg_public_key: ""
|
|
|
|
# ── Duo (Admin Panel -> Applications -> OpenVPN/RADIUS) ──
|
|
duo_ikey: ""
|
|
duo_skey: ""
|
|
duo_api_host: api-XXXXXXXX.duosecurity.com
|
|
|
|
# ── AD service account for the Duo Auth Proxy (read-only) ──
|
|
duo_svc_user: svc-duoproxy # sAMAccountName, not UPN
|
|
duo_svc_password: ""
|
|
ad_search_dn: DC=ad,DC=atlashorizon,DC=net
|
|
# Only used if you uncomment security_group_dn in authproxy.cfg.template:
|
|
duo_security_group_dn: ""
|
|
|
|
# ── OpenVPN <-> Duo RADIUS shared secret (openssl rand -hex 24) ──
|
|
radius_secret: ""
|
|
|
|
# ── Technitium web console admin password ──
|
|
# Seeded on the FIRST container start only; afterwards change it in the
|
|
# console (this var must still match for the init job's API login).
|
|
technitium_admin_password: ""
|
|
|
|
# DNS zone where VPN clients get registered as <username>.<zone> with a
|
|
# matching PTR (Technitium primary zone, created by the init job). Set to
|
|
# "" to disable registration.
|
|
vpn_dns_zone: roam.atlashorizon.net
|
|
|
|
# ── Optional ──
|
|
# Pin for deterministic Duo updates (e.g. "6.5.1"); bumping it forces a
|
|
# refetch of the tarball on the next rebuild.
|
|
duo_authproxy_version: latest
|
|
# vpnhub_base_dir: /opt
|