---
# Keep Atlas management gates disabled until the NAS and required Vault inputs are ready.
hostname: atlas
ansible_host: 192.168.178.55
ansible_user: "{{ atlas_connection_username }}"
ansible_port: 22
ansible_ssh_private_key_file: /home/fscotto/.ssh/id_ed25519

atlas_admin_username: admin
atlas_connection_username: "{{ atlas_admin_username }}"
atlas_admin_group: "{{ atlas_admin_username }}"
atlas_admin_home: "/home/{{ atlas_admin_username }}"
atlas_admin_uid: 1000
atlas_admin_gid: 1000
atlas_admin_ssh_keys: "{{ vault_atlas_authorized_ssh_keys | default([]) }}"
atlas_admin_password_hash: "{{ vault_atlas_admin_password_hash | default('!') }}"

atlas_lan_subnet: 192.168.178.0/24
atlas_aegis_ip: 192.168.178.54
atlas_manage_firewall: false
atlas_firewalld_zone: public
atlas_zfs_pool: zpool
atlas_zfs_dataset_work: work
atlas_zfs_dataset_archive: archive
atlas_zfs_dataset_music: media/music
atlas_zfs_dataset_syncthing: syncthing
atlas_zfs_dataset_backup_prometheus: backup_prometheus
atlas_zfs_dataset_icloud_photos: media/icloud_photos
atlas_zfs_dataset_service_backups: backups/services
atlas_mount_root: /zpool
atlas_manage_storage: false
atlas_manage_media_stack: false

rocky_manage_openzfs_repo: true
rocky_manage_syncthing_binary: true
rocky_manage_podman: true
rocky_podman_packages:
  - podman

host_packages:
  - cockpit
  - nfs-utils
  - policycoreutils-python-utils
  - samba
  - samba-client
  - samba-common-tools
  - zfs

atlas_nfs_exports:
  - path: "{{ atlas_icloud_photos_mountpoint }}"
    client: "{{ atlas_aegis_ip }}"
    options:
      - rw
      - sync
      - no_subtree_check
      - all_squash
      - "anonuid={{ atlas_immich_uid }}"
      - "anongid={{ atlas_immich_gid }}"

atlas_samba_share_name: Archive
atlas_samba_workgroup: WORKGROUP
# Append any pre-existing laptop Unix account here and keep its Samba password in Vault.
atlas_samba_accounts:
  - username: "{{ atlas_admin_username }}"
    password: "{{ vault_atlas_samba_password | default('') }}"
atlas_samba_valid_users: "{{ atlas_samba_accounts | map(attribute='username') | list }}"

atlas_immich_db_password: "{{ vault_atlas_immich_db_password | default('') }}"

atlas_firewalld_rich_rules:
  - 'rule family="ipv4" source address="{{ atlas_lan_subnet }}" service name="ssh" accept'
  - 'rule family="ipv4" source address="{{ atlas_lan_subnet }}" service name="cockpit" accept'
  - 'rule family="ipv4" source address="{{ atlas_aegis_ip }}" service name="nfs" accept'
  - 'rule family="ipv4" source address="{{ atlas_lan_subnet }}" service name="samba" accept'
  - 'rule family="ipv4" source address="{{ atlas_lan_subnet }}" service name="http" accept'
  - 'rule family="ipv4" source address="{{ atlas_lan_subnet }}" service name="https" accept'

host_enabled_services:
  - sshd
  - cockpit.socket
  - zfs.target