---

# ---
# vars used by roles/network_interfaces
# ---

# If true, all additional files in /etc/network/interfaces/interfaces.d/ are deleted
network_manage_devices: True

# Should the interfaces be reloaded after config change?
network_interface_reload: False

network_interface_path: /etc/network/interfaces.d
network_interface_required_packages:
  - vlan
  - bridge-utils
  - ifmetric
  - ifupdown
  - ifenslave


network_interfaces:

  - device: br0
    # use only once per device (for the first device entry)
    headline: br0 - bridge over device eth0

    # auto & allow are only used for the first device entry
    allow: [] # array of allow-[stanzas] eg. allow-hotplug
    auto: true

    family: inet
    method: manual
    hwaddress: 52:54:00:48:ce:dc
    description:
    address:
    netmask:
    gateway:
    metric:
    pointopoint:
    mtu:
    scope:

    # additional user by dhcp method
    #
    hostname:
    leasehours:
    leasetime:
    vendor:
    client:

    # additional used by bootp method
    #
    bootfile:
    server:
    hwaddr:

    # optional dns settings nameservers: []
    #
    #    nameservers:
    #      - 194.150.168.168  # dns.as250.net
    #      - 91.239.100.100   # anycast.censurfridns.dk
    #    search: warenform.de
    #
    nameservers:
      - 195.201.179.131
      - 95.217.204.204
    search: oopen.de warenform.de

    # optional additional subnets/ips subnets: []
    # subnets: 
    #   - '192.168.123.0/24'
    #   - '192.168.124.11/32'

    # optional bridge parameters bridge: {}
    # bridge:
    #   ports:
    #   stp:
    #   fd:
    #   maxwait:
    #   waitport:
    bridge:
      ports: eth0 # for mor devices support a blank separated list
      stp: !!str off
      fd: 1
      hello: 2
      maxage: 12

    #  optional bonding parameters bond: {}
    #  bond:
    #    master
    #    primary
    #    slave
    #    method:
    #    miimon:
    #    lacp-rate:
    #    ad-select-rate:
    #    master:
    #    slaves:
    bond: {}

    # optional vlan settings | vlan: {}
    # vlan: {}
    #   raw-device: 'eth0'
    vlan: {}

    # inline hook scripts
    pre-up: [] # pre-up script lines
    up: 
      - !!str "ip addr add 83.223.85.203/24 dev br0"
      - !!str "ip route add default via 83.223.85.1"
    post-up: [] # post-up script lines (alias for up)
    pre-down: [] # pre-down script lines (alias for down)
    down: [] # down script lines
    post-down: [] # post-down script lines
  
# ---
# vars used by roles/ansible_dependencies
# ---


# ---
# vars used by roles/ansible_user
# ---


# ---
# vars used by roles/common/tasks/basic.yml
# ---


# ---
# vars used by roles/common/tasks/sshd.yml
# ---


# ---
# vars used by roles/common/tasks/apt.yml
# ---


# ---
# vars used by roles/common/tasks/cron.yml
# ---

cron_env_entries:
  - name: PATH
    job: /root/bin/admin-stuff;/root/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin

  - name: SHELL
    job: /bin/bash
    insertafter: PATH


cron_user_special_time_entries:

  - name: "Restart DNS Cache service 'systemd-resolved'"
    special_time: reboot
    job: "sleep 5 ; /bin/systemctl restart systemd-resolved"
    insertafter: PATH

  - name: "Check if postfix mailservice is running. Restart service if needed."
    special_time: reboot
    job: "sleep 10 ; /root/bin/monitoring/check_postfix.sh > /dev/null 2>&1"
    insertafter: PATH

  - name: "Check if Check if all autostart LX-Container are running."
    special_time: reboot
    job: "sleep 120 ; /root/bin/LXC/boot-autostart-lx-container.sh"
    insertafter: PATH


cron_user_entries:

  - name: "Check if SSH service is running. Restart service if needed."
    minute: '*/5'
    hour: '*'
    job: /root/bin/monitoring/check_ssh.sh

  - name: "Check connectifity - reboot if needed"
    minute: '*/10'
    hour: '*'
    job: /root/bin/admin-stuff/check-connectivity.sh

  - name: "Check if Postfix Mailservice is up and running?"
    minute: '*/15'
    hour: '*'
    job: /root/bin/monitoring/check_postfix.sh

  - name: "Check if NTP service 'ntpsec' is up and running?"
    minute: '*/30'
    hour: '*'
    job: /root/bin/monitoring/check_ntpsec_service.sh > /dev/null 2>&1

  - name: "Clean up Samba Trash Dirs"
    minute: '02'
    hour: '23'
    job: /root/bin/samba/clean_samba_trash.sh

  - name: "Set (group and access) Permissons for Samba shares"
    minute: '14'
    hour: '23'
    job: /root/bin/samba/set_permissions_samba_shares.sh

  - name: "Check hard disc usage."
    minute: '43'
    hour: '6'
    job: /root/bin/admin-stuff/check-disc-usage.sh -c 85


# ---
# vars used by roles/common/tasks/users.yml
# ---

default_user:

  - name: chris
    password: $6$bSHlaLHC$URSMVq090e/cJ1v55Jh9ws0w5WekhO7X3Y0RqryAl5R76K9khWBegC76Smjastja.xMiD57/LzUUXW7y9NvAL.
    shell: /bin/bash
    ssh_keys:
      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'

  - name: c3po
    password: $6$z0yywBoF$VtusXNrSvL4s4kQSeCl/6rZoCcAOz0aSINm0ArntILNvLnurVDGk9nJz42ZMya/DFe8snlf5kLymeAmNRiyDK/
    shell: /bin/bash
    ssh_keys:
      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
      - 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDinfnbnVooKT0iFpkZeRZMj8JpYJk+EkgGHyK2xhb0HNoYvDoG06Clckm0vauuRlSYnWkZC0dLIbqHlACA+jbCKa2w/5yOjCXmJiJEO04YCMhkQH08It+wpWZb/Bx2O6DB3cY+3mHwPocp/la8caYW4NIE5+67AnHxIQifJLXM44TgkmFEhXSBMIZj8b8wL+MA0zKD0LXwgEH9Wllcccq6D5lfsrUSLvTRHq362pE+ZtVXh2peVkS4r98HNtYVUjBMgOIIPEypopceUzXC0L+vB7s2SolAsh3CGjqyjYW8x3fWnAewlfa5TbgIC+11e+KJKFr5+tVfwSgHC+TtfuXDU5Ws80ETejbuwx2iRVfHG0fDcjPzaVUXGmY+j8OR4jACz5KY5+VMJgMuXJTbZBEf1C5O3lCTaEf/Pmw50SHrshT/bhdrMBUaS+AOTFHrI3WOu+ujWMXJK3pRdROXDFDtPfc1afaJkMuKO5Uay/qwTEKd8NwXNoAGkXjowKBerNgJRy5JwhmbHMA6xsCDEjXMVy+yiMw+58JE76g5HVVu7dpyz0bjXD3LrpB+lclQHRLxNajWAjVsAu/eI2zQDDS7YHi1IZVUGdYD0g0qXdeNQ//KA7FVr22VFUP8xtbseZfOZpKFGVEMVkIOcYHZoYhOYxZDVNNmvle13F4PU1zOiQ== c3po@riseup.net'

  - name: sysadm
    user_id: 1050
    group_id: 1050
    group: sysadm
    password: $6$EEVWxA5E$bNxU8EOp/tTcYVghFharUM10k3vRt2siEnIiiznfGmhMSM6zJTP0umdxql9VVEj856oKa.Sp.q3N2nthgNMeN1
    shell: /bin/bash
    ssh_keys:
      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'

  - name: localadmin
    user_id: 1051
    group_id: 1051
    password: $6$flo5afeu$1Dn/tqIOJIFQbymCzpJk9BgGflQdy2Eg0nTiMBF7VefN7uY/Md1pV2yU0S47kZuH5aDjSdPfKzhHp8Aul/xx90
    shell: /bin/bash
    ssh_keys:
      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'
      - 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDFkl+5aVg4l40bxmf6k2dpopV8oAXyLhGGmKfzspW3GTfD29WjhuGS/mefrqr3tZRYrybPA5GDQ1QdwwRL16+6xfjAt/B62p3dMXnjsHalk74DTcQCZDlsj0UxTV1+gfOYzcB/CAqRd2wtB+vqGWRP+oGP3E7AIgoBlE44MaEDDuMP0Vvm8hNQ5N+/3zcrE626yDHAa4qmOd5d+J/HWrHLeJ4915g9VcCYCNGCgepb//4RdCpzEqUJiBGwihb/iJk3RoHcAv3L+tht8vmBF7Wz0iJ9BtLRTsJGFCkET0i50E18mU3bfaa7ov/PY/+UcE8FZSWZcoZ6AtmoBy0Zg2mp6/F9serfe67qtILNAbWD+qNRC7GjW3c5UvF5GJM6WvG8OZRvwarovZOU8uw1NLL3unY8O1bdihXmCXatXz+MvHCOvmZekUolKMBu7mziH5wificprUY9YeGX1FHVh4/hsL04zZdu/Q8Rr/BxM8+mJCCPsrkEoNnZNJfxCSwynd3jjqkhBpzZkEW9EGDBG5qnx4f6QPtcf/sv7eoNjzhEUs5k9GstbgW0ZD6381Ws/EpIdRbZUl52wFXalE8N/Z9hU6vfBC1xk0DIardUkZk+6lTsS8orBZkmPDNhX5hT8nmwNszQI0WgHPs+xDAdFskMcB/j20G5NupZm+2QgNXoww== jonas@meurer.it'
      - 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDCzd5rFYvV5/V2NZE4jxL09qZ4TTsgmhbfSHpsj9wX89+j7ZrfTAkAkAFxyrWs8FR3CQ11DGkrXW059a0ppRQ7R8bUW9CniXS/RaRAvqX9AMM9Xo/lmL4pXNM0sV4nHJWphi5Bc+zTIM2I4PSbHYw+5dDnj8ZIQ8ucBff+k29Zd90JRuKx72tk0pQNf7sQbWVKNCT/B4g4MJV84NvnO+ExCWvGM95Cy5NCTnQfO94/OSkN72R//tIR7Nd/aK7hEj69MoVJZrFy4qzE9KskLhKeUYCqoz86XOQ6Dfag/B2adTeG3r9DEacG3ao/ACZKQChj0X12LEV/PZUHLORqYpWIwMuIx54vhbxarSwlKhoOCv1XQJwo9BTavMhFNsMtZpAJYdvAakRCbf18bDrHyqYYqjAyYOp+L+G+wlSh3tz0qQL8aAnaV3RPN0fDd7Zu1dpMGAM2gMnBEMJ+k82V7EtACp1jf37LW11Lbv2o+dRUJEgsrU9TNGxaGSTWqGc65TuP9PUfDXq1ZNOPQWSK/KseqB0WUx6ePfZzkgkr7kGXT/d9hUSCq2+iprhfwQpYLcXE9XtCdo1aivIKQ8zCuR44q11HePyNtEMaJfq33p4uDTVOy7UOtuACzSbk6vs7h6h8CUGPwU9aw+PRiWY4Jdm0caJ8trFfH1R8XaIe3SaUEw== t@NB-003258-RLS'

  - name: back
    user_id: 1060
    group_id: 1060
    group: back
    password: $6$GntX81EP$O1GEmQF.BbOQfTMMw/m/BDKSXmANVpqmz0nyzw4O4R2/iK9huGOAjT/2eq8FVdMghvNOvdwrWtwohO.Mg4V9n.
    shell: /bin/bash
    ssh_keys:
      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO90culn3sicU2chTHn40ytcTay0nUIHap0uF/5fVM6P chris@sol'
      - 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOQHMUKlDh2ufno5pZOhUY5xFljC1R5zQ/GjOHDkS58D root@sol'

sudo_users:
  - chris
  - sysadm
  - localadmin


# ---
# vars used by roles/common/tasks/users-systemfiles.yml
# ---


# ---
# vars used by roles/common/tasks/webadmin-user.yml
# ---


# ---
# vars used by roles/common/tasks/sudoers.yml
# ---
#
# see: roles/common/tasks/vars


# ---
# vars used by roles/common/tasks/caching-nameserver.yml
# ---


# ---
# vars used by roles/common/tasks/git.yml
# ---

git_firewall_repository:
  name: ipt-server
  repo: https://git.oopen.de/firewall/ipt-server
  dest: /usr/local/src/ipt-server


# ---
# vars used by roles/common/tasks/samba-config-server.yml
# vars used by roles/common/tasks/samba-user.yml
# ---

samba_server_ip: 83.223.85.203
samba_server_cidr_prefix: 24

samba_workgroup: AH

samba_netbios_name: FILE-AH

samba_groups:
  - name: verwaltung
    group_id: 1200
  - name: intern
    group_id: 1210
  - name: hoffmann-elberling
    group_id: 1220
  - name: gubitz-partner
    group_id: 1230

samba_user:
  - name: buero
    groups:
      - verwaltung
      - intern
    password: 'buero2011'
  - name: axel
    groups:
      - intern
      - verwaltung
      - hoffmann-elberling
    password: 'ah-kiel.2018'
  - name: bjoern
    groups:
      - intern
      - verwaltung
      - hoffmann-elberling
    password: 'bjoern2011'
  - name: gubitz
    groups:
      - intern
      - verwaltung
      - gubitz-partner
    password: '20gubitz12'
  - name: schaar
    groups:
      - intern
      - verwaltung
      - gubitz-partner
    password: '20schaar12'
  - name: molkentin
    groups:
      - intern
      - verwaltung
      - gubitz-partner
    password: 20molkentin12
  - name: buerooben
    groups:
      - intern
      - verwaltung
      - hoffmann-elberling
    password: 'buero2013'
  - name: back
    groups: []
    password: !vault |
          $ANSIBLE_VAULT;1.1;AES256
          63643330373231636537366333326630333265303265653933613835656262323863363038653234
          3462653135633266373439626263356636646637643035340a653466356235346663626163306363
          61313164643061306433643738643563303036646334376536626531383965303036386162393832
          6631333038306462610a356535633265633563633962333137326533633834636331343562633765
          3631
  - name: buchholz
    groups:
      - buero
      - intern
      - verwaltung
    password: '20-buch_holz-20'
  - name: schmidt
    groups:
      - intern
      - verwaltung
      - gubitz-partner
    password: '20-schmidt_21%'
  - name: kiel-nb1
    groups:
      - buero
      - intern
      - verwaltung
      - gubitz-partner
      - hoffmann-elberling
    password: '20-note%book1-20'
  - name: kiel-nb2
    groups:
      - buero
      - intern
      - verwaltung
      - gubitz-partner
      - hoffmann-elberling
    password: '20-note%book2-20'
  - name: chris
    groups:
      - buero
      - intern
      - verwaltung
      - gubitz-partner
      - hoffmann-elberling
    password: !vault |
          $ANSIBLE_VAULT;1.1;AES256
          63643330373231636537366333326630333265303265653933613835656262323863363038653234
          3462653135633266373439626263356636646637643035340a653466356235346663626163306363
          61313164643061306433643738643563303036646334376536626531383965303036386162393832
          6631333038306462610a356535633265633563633962333137326533633834636331343562633765
          3631

base_home: /home

# remove_samba_users:
#   - name: name1
#   - name: name2
#
remove_samba_users: []

samba_shares:
  - name: profiles-RDP
    comment: Users profiles RDP
    path: /data/samba/profiles-RDP
    guest_ok: !!str no
    browseable: !!str no
    valid_users: '%S'
    file_create_mask: !!str 600
    dir_create_mask:  !!str 700

  - name: Buero
    path: /data/samba/shares/Buero
    group_valid_users: intern
    group_write_list: intern
    file_create_mask: !!str 664
    dir_create_mask: !!str 2775
    vfs_object_recycle: true
    recycle_path: recycle

  - name: Verwaltung
    path: /data/samba/shares/Verwaltung
    group_valid_users: verwaltung
    group_write_list: verwaltung
    file_create_mask: !!str 660
    dir_create_mask: !!str 2770
    vfs_object_recycle: true
    recycle_path: recycle

  - name: Scans_schnell 
    path: /data/samba/shares/Scans_schnell
    group_valid_users: intern
    group_write_list: intern
    file_create_mask: !!str 664
    dir_create_mask: !!str 2775
    vfs_object_recycle: true
    recycle_path: recycle

  - name: Hoffmann-Elberling
    path: /data/samba/shares/Hoffmann-Elberling
    group_valid_users: hoffmann-elberling
    group_write_list: hoffmann-elberling
    file_create_mask: !!str 664
    dir_create_mask: !!str 2775
    vfs_object_recycle: true
    recycle_path: recycle

  - name: Gubitz-Partner
    path: /data/samba/shares/Gubitz-Partner
    group_valid_users: gubitz-partner
    group_write_list: gubitz-partner
    file_create_mask: !!str 664
    dir_create_mask: !!str 2775
    vfs_object_recycle: true
    recycle_path: recycle

  - name: Gubitz-Backup
    path: /data/samba/shares/Gubitz-Backup
    group_valid_users: gubitz
    group_write_list: gubitz
    file_create_mask: !!str 660
    dir_create_mask: !!str 2770
    vfs_object_recycle: true
    recycle_path: recycle

  - name: WinServer2016-Backup
    comment: WinServer2016-Backup on Fileserver
    path: /data/samba/shares/WinServer2016-Backup
    group_valid_users: {}
    group_write_list: {}
    file_create_mask: !!str 664
    dir_create_mask: !!str 2775
    guest_ok: !!str yes
    vfs_object_recycle: true
    recycle_path: {}

  - name: Advoware-Backup
    comment: Advoware-Backup (only read) on Fileserver
    path: /data/samba/shares/Advoware-Backup
    group_valid_users: back
    group_write_list: back
    file_create_mask: !!str 664
    dir_create_mask: !!str 2775
    guest_ok: !!str yes
    vfs_object_recycle: true



# ==============================


# ---
# vars used by scripts/reset_root_passwd.yml
# ---

root_user:
  name: root
  password: $6$J1ssJfdshf/$mknQEPDcW4HN5.wFfawbamamywI7F7fhdZmaR1abNrc4DA7DNRx766lz3ygf9YV3gcmRq3QhJ3fBVlkwGMCvq.
