---
# =============================================================================
# linux-baseline — default variables
#
# Every section can be turned off independently, so the role can be adopted one
# piece at a time. Defaults are deliberately safe: nothing here assumes anything
# about a specific network, employer, or user.
# =============================================================================

# --- Section toggles ---------------------------------------------------------
linux_baseline_manage_packages: true
linux_baseline_manage_users: true
linux_baseline_manage_ssh: true
linux_baseline_manage_sysctl: true
linux_baseline_manage_updates: true
linux_baseline_manage_journald: true

# --- Packages ----------------------------------------------------------------
linux_baseline_packages:
  - ca-certificates
  - chrony            # reliable time sync; correct clocks matter for auth/logs
  - curl
  - htop
  - vim
# Removed by default to shrink the attack surface on a headless server.
linux_baseline_packages_absent: []

# --- Admin users -------------------------------------------------------------
# Supply real users at the playbook/inventory level. Each entry looks like:
#   - name: alice
#     shell: /bin/bash            # optional
#     authorized_keys:
#       - "ssh-ed25519 AAAA... alice@laptop"
linux_baseline_admin_users: []
linux_baseline_admin_group: admins
linux_baseline_admin_nopasswd: false
# When true, authorized_key manages the file exclusively (removes stray keys).
linux_baseline_authorized_keys_exclusive: false

# --- SSH hardening -----------------------------------------------------------
linux_baseline_ssh_service_name: ssh
linux_baseline_ssh_permit_root_login: "no"
# Password auth is OFF by default. The role refuses to apply this unless at
# least one admin user has an authorized key, so you can't lock yourself out.
linux_baseline_ssh_password_authentication: false
linux_baseline_ssh_kbd_interactive_authentication: false
linux_baseline_ssh_x11_forwarding: false
linux_baseline_ssh_max_auth_tries: 3
linux_baseline_ssh_login_grace_time: 30
linux_baseline_ssh_client_alive_interval: 300
linux_baseline_ssh_client_alive_count_max: 2
# Restrict who may log in. Empty lists mean "no restriction line emitted".
linux_baseline_ssh_allow_users: []
linux_baseline_ssh_allow_groups:
  - "{{ linux_baseline_admin_group }}"

# --- sysctl hardening --------------------------------------------------------
linux_baseline_sysctl:
  net.ipv4.conf.all.rp_filter: "1"
  net.ipv4.conf.default.rp_filter: "1"
  net.ipv4.conf.all.accept_source_route: "0"
  net.ipv4.conf.all.accept_redirects: "0"
  net.ipv4.conf.all.send_redirects: "0"
  net.ipv4.conf.all.log_martians: "1"
  net.ipv4.icmp_echo_ignore_broadcasts: "1"
  net.ipv4.tcp_syncookies: "1"
  net.ipv6.conf.all.accept_redirects: "0"
  net.ipv6.conf.all.accept_source_route: "0"
  kernel.randomize_va_space: "2"

# --- Automatic updates -------------------------------------------------------
# Only the security pocket is auto-installed by default.
linux_baseline_unattended_automatic_reboot: false
linux_baseline_unattended_automatic_reboot_time: "03:00"

# --- journald ----------------------------------------------------------------
linux_baseline_journald_max_use: 500M
linux_baseline_journald_max_retention: 30day