---
ansible_host: aegis
ansible_connection: ssh
ansible_user: pi
ansible_become: true
ansible_python_interpreter: /usr/bin/python3
# Avoid PTY framing around module JSON on this remote Fedora IoT host.
ansible_ssh_use_tty: false

aegis_lan_subnet: 192.168.178.0/24
aegis_adguard_web_port: 80
aegis_network_connection_name: FRITZ!Box 7530 NR
aegis_network_connection_uuid: a52fda3d-3eb6-351f-bf04-753edcb76944
aegis_host_dns_servers:
  - 192.168.178.1
aegis_host_dns_search_domains:
  - fritz.box

# Aegis is the internal WireGuard endpoint and NAT gateway for the LAN.
wireguard_overlay_enabled: true
wireguard_address: 10.0.0.2/24
wireguard_enable_ipv4_forwarding: true
wireguard_reload_rootful_podman_networks: true
wireguard_forwarding_policies:
  - name: aegis-wireguard-to-lan
    ingress_zone: wireguard
    egress_zone: public
    source: 10.0.0.0/24
    destination: "{{ aegis_lan_subnet }}"
    masquerade: true
wireguard_peers:
  - name: prometheus
    host: prometheus
    endpoint: "{{ hostvars['prometheus']['ansible_host'] }}:{{ hostvars['prometheus']['wireguard_listen_port'] }}"
    allowed_ips:
      - 10.0.0.0/24
    persistent_keepalive: 25
aegis_ssh_authorized_keys:
  - name: ikaros
    key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINrIxXjA3ffPwziKGR5gzc4gAoBehQPlnEMcXF4Wl0ZS ikaros"
  - name: nymph
    key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEH/7GJfGt0ZVmKeEzceoFkFkeCXFryKK9vAbaip+HCx nymph"
  - name: siren
    key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIA95wYlzpfN3rjUhpMeP4KHn8I6ZrjQXoDTgwgRIa++b siren"

aegis_icloudpd_apple_id: "{{ vault_aegis_icloudpd_apple_id | default('') }}"