--- # Network configuration # --------------------- network_interfaces: - name: lan0 type: ethernet mac_address: 02:a0:c9:8d:7e:b6 ipv4: address: 192.168.1.2/24 gateway: 192.168.1.254 nameservers: - 1.1.1.1 - 8.8.8.8 - name: lan1 type: ethernet mac_address: 0a:3f:5b:1c:d2:e4 # Unbound DNS resolver configuration # ---------------------------------- unbound_custom_lan_domain: "example.lan" unbound_interfaces: - { address: "192.168.1.2", comment: "lan0" } - { address: "192.168.20.4", comment: "wg0" } unbound_access_control: - { subnet: "192.168.1.0/24", action: "allow", view: "lan", comment: "lan0" } - { subnet: "192.168.20.0/27", action: "allow", view: "vpn", comment: "wg0" } unbound_custom_lan_config_path: "{{ unbound_config_base_path }}/lan.conf" unbound_custom_lan_records: "server.example.lan": v4: 192.168.1.2 aliases: - "server" # unbound VPN configuration unbound_custom_vpn_config_path: "{{ unbound_config_base_path }}/vpn.conf" unbound_custom_vpn_records: "server.example.lan": v4: 192.168.20.4 aliases: - "server" unbound_firewall_allowed_sources: - { src: "192.168.1.0/24", comment: "DNS from LAN" } - { src: "192.168.20.0/27", comment: "DNS from VPN" } # Unbound Prometheus exporter (Arch Linux only) # unbound_exporter_enabled: true # NTP servers configuration # ------------------------- ntp_pools: - "0.uk.pool.ntp.org" - "1.uk.pool.ntp.org" - "2.uk.pool.ntp.org" - "3.uk.pool.ntp.org" ntp_timezone: "Europe/London" ntp_allowed_networks: - "127.0.0.1" - "::1" - "192.168.1.0 mask 255.255.255.0" - "192.168.20.0 mask 255.255.255.224" ntp_firewall_allowed_sources: - 192.168.1.0/24 # lan0 - 192.168.20.0/27 # wg0 disk_partitioning: - device: /dev/nvme0n1 layout_file: inventory_data/partition_layouts/omer.nvme0n1.sfdisk partitions: - name: EFI device: /dev/nvme0n1p1 size: 512M type: EFI - name: SWAP device: /dev/nvme0n1p2 size: 1G type: swap - name: ROOT device: /dev/nvme0n1p3 size: 500G type: ext4 - name: SLOG device: /dev/nvme0n1p4 size: 400G type: zfs - name: CLUB device: /dev/nvme0n1p5 size: 2.7TiB type: zfs # ZFS pool configuration # ---------------------- zfs_pools: - name: omer type: raidz1 devices: - ata-SAMSUNG_MZ7LN512HMJP-00000_S1G2NSAF934567 - ata-SAMSUNG_MZ7LN512HMJP-00000_S1G3NSAF934568 options: ashift: 12 root: /mnt/omer state: present zfs_datasets: - name: omer/photos extra_zfs_properties: mountpoint: /mnt/omer/photos state: present - name: omer/movies extra_zfs_properties: mountpoint: /mnt/omer/movies state: present # Wireguard VPN configuration # ---------------------------- wireguard_tunnels: - interface: wg0 address: 192.168.20.4/27 dns: 192.168.20.1 server_mode: false peers: - name: "Marge server" public_key: fB6zC8oWpQxN4yR2sT1uA7vJ9kH3mG5eD0cLlI8bV6aF2dP3eXwZ1qY4rU7tO9 allowed_ips: - 192.168.20.1/32 endpoint: 192.168.1.56:51820 # NFS server configuration # ------------------------ nfs_clients: - name: all_wg0_rw_clients host: "192.168.20.0/255.255.255.224" options: "rw,sync,no_subtree_check,all_squash,anonuid=1000,anongid=1000,insecure" - name: laptop_lan0_rw_clients host: "192.168.1.167" options: "rw,sync,no_subtree_check,all_squash,anonuid=1000,anongid=1000,insecure" nfs_shares: - dir: /mnt/omer/movies clients: "{{ nfs_clients }}" - dir: /mnt/omer/photos clients: "{{ nfs_clients }}" nfs_server_firewall_allowed_sources: - 192.168.1.0/24 # lan0 - 192.168.20.0/27 # wg0 nfs_bind_addresses: - 192.168.20.4 - 192.168.1.2 # Podman configuration # -------------------- # Address inside containers that maps to the host's loopback (via pasta # --map-host-loopback). Containers reach host services bound to 127.0.0.1 # by connecting to this address. Defined in roles/podman/defaults/main.yml. # podman_gw_gateway: 100.64.0.1 # PostgreSQL configuration # ------------------------ postgres_admin_password: "{{ vault_postgres_admin_password }}" postgres_bind: "127.0.0.1" postgres_firewall_allowed_sources: - 127.0.0.0/8 # Valkey configuration # -------------------- valkey_admin_password: "{{ vault_valkey_admin_password }}" valkey_bind: "127.0.0.1" valkey_firewall_allowed_sources: - 127.0.0.0/8 # Valkey ACL users valkey_acl_users: - username: immich password: "{{ vault_immich_valkey_password }}" keypattern: "immich_bull* immich_channel*" commands: "&* -@dangerous +@read +@write +@pubsub +select +auth +ping +info +eval +evalsha" # Immich configuration # -------------------- immich_postgres_password: "{{ vault_immich_postgres_password }}" immich_valkey_password: "{{ vault_immich_valkey_password }}" # Backup configuration # -------------------- # restic: encrypted, deduplicated, incremental. See roles/backup/README.md. # Destinations. `repository` is RESTIC_REPOSITORY verbatim. Retention lives # here: a large local disk can afford more history than metered object storage. # Each destination can carry its own `notify` channel for fine-tuned alerts. backup_repositories: - name: offsite # Two hosts must never share a repository - keep the paths distinct. repository: "s3:https://s3.fr1.next.ink/lisez-next/{{ inventory_hostname }}" password: "{{ vault_backup_offsite_password }}" env: AWS_ACCESS_KEY_ID: "{{ vault_backup_s3_access_key }}" AWS_SECRET_ACCESS_KEY: "{{ vault_backup_s3_secret_key }}" AWS_DEFAULT_REGION: fr1 retention: keep_weekly: 4 # Re-hash 5% of the pack files on each run, so the whole repository gets # verified over time without a full read every week. read_data_subset: "5%" notify: server: https://ntfy.example.org topic: sys-alerts token: "{{ vault_backup_ntfy_token }}" # Removable disk. Skipped without error when it is not plugged in - alert at # low priority rather than urgent, so a disk in a drawer is a reminder, not # an alarm. # - name: usb # repository: /mnt/backup-usb/restic # uuid: 1234-5678-90ab # blkid; never /dev/sdX, it renumbers # mountpoint: /mnt/backup-usb # fstype: ext4 # password: "{{ vault_backup_usb_password }}" # retention: # keep_weekly: 12 # notify: # topic: backups-reminders # Always-present filesystem, e.g. a ZFS dataset. # - name: nas # repository: /mnt/andromeda/backups/restic # password: "{{ vault_backup_nas_password }}" # retention: # keep_daily: 7 # keep_weekly: 4 # Sources. Dumps are produced once and pushed to every listed repository. backup_jobs: # WHAT gets backed up is declared by the service role (ntfy_backup_paths / # ntfy_backup_exclude / ntfy_backup_sqlite in roles/ntfy/defaults/main.yml); # only WHERE (repositories, retention, schedule) is decided here. The ntfy # role knows its storage layout - cache.db is ephemeral and skipped, user.db # is dumped with sqlite3 .backup rather than copied (torn -wal risk). - name: ntfy repositories: [offsite] paths: "{{ ntfy_backup_paths }}" exclude: "{{ ntfy_backup_exclude }}" sqlite: "{{ ntfy_backup_sqlite }}" # Databases only, no files. pg_dumpall --globals-only is always included. # - name: databases # repositories: [offsite, nas] # postgres: all # command: | # valkey-cli --rdb "$DUMPS/valkey.rdb"