ansible/.env.example at master · ContainerCraft/ansible · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
# =============================================================================
# ContainerCraft/ansible — OPNsense edge automation environment template
# =============================================================================
#
# Copy to `.env` and fill in. `.env` is gitignored; `.env.example` is committed.
#   cp .env.example .env && $EDITOR .env
#
# Every variable below is read by the playbook via lookup('env', ...) (see
# opnsense/vars/values.example.yml and inventory/group_vars/all.yml). Non-secret
# values ship with working defaults for the live lab box; secrets are blank and
# MUST be supplied (here or, preferably, via the sesame vault — the .envrc
# sources sesame export before .env, so vault values win unless overridden).
#
# The single operator surface is opnsense/vars/values.yml (copied from
# values.example.yml); it reads these env vars. Nothing here is required to be
# set if the corresponding value is provided directly in values.yml.

# -----------------------------------------------------------------------------
# API connection (REQUIRED — no working default for secrets)
# -----------------------------------------------------------------------------
# Mint on the box: System -> Access -> Users -> (ansible user) -> API keys -> +
# Downloads a key/secret pair. Leave blank to source from sesame instead.
OPNSENSE_API_KEY=
OPNSENSE_API_SECRET=

# API endpoint of the firewall. Default is the live lab edge router.
OPNSENSE_FIREWALL=10.0.0.1
OPNSENSE_API_PORT=443

# Validate the firewall TLS cert. false for the self-signed lab cert; set true
# in production and supply ssl_ca_file in values.yml for an internal CA.
OPNSENSE_SSL_VERIFY=false

# -----------------------------------------------------------------------------
# Migration posture (REQUIRED — gates which services run where)
# -----------------------------------------------------------------------------
# coexist | migrating | hardening | converged. Monotonic. Start at coexist:
# the new edge stands up beside the live LAN without touching 10.0.0.0/24.
OPNSENSE_NETWORK_PHASE=coexist

# -----------------------------------------------------------------------------
# System identity (applied only when opnsense_apply_identity=true; wizard semantics)
# -----------------------------------------------------------------------------
OPNSENSE_HOSTNAME=opnsense
OPNSENSE_DOMAIN=home.arpa
OPNSENSE_TIMEZONE=America/Los_Angeles

# -----------------------------------------------------------------------------
# High availability (consumed only when opnsense_ha_enabled=true)
# -----------------------------------------------------------------------------
# CARP VHID group password (shared across the cluster's VIPs) and the HA
# config-sync (XMLRPC) credentials. Secrets — leave blank, source from sesame.
OPNSENSE_CARP_PASSWORD=
OPNSENSE_HASYNC_USERNAME=root
OPNSENSE_HASYNC_PASSWORD=

# -----------------------------------------------------------------------------
# Devshell / sesame (consumed by .envrc, not the playbook)
# -----------------------------------------------------------------------------
# SESAME_PROFILES=default
# DEVSHELL_FLAKE=path:.
# DEVSHELL_NAME=default