# Ansible group vars — applied to all managed hosts.
#
# custodian_agent_pubkey: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC/V9fe5MGKdhTBz9KwEvC1NE+HjdoCtQocpGxP6Pko9 custodian-agent"
#
# HOW TO SET THIS:
#   1. Generate the keypair on the workstation (one-time):
#        cd ~/the-custodian && make custodian-keygen
#      This creates ~/.ssh/id_custodian_agent (private, never committed)
#      and writes the public key to:
#        ~/railiance-infra/ansible/inventory/group_vars/all.yaml  ← this file
#
#   2. Commit the updated all.yaml (public key only — safe to commit).
#
#   3. Deploy to all managed hosts:
#        cd ~/railiance-infra && make provision-custodian-agent
#
# The key below is a placeholder — replace by running `make custodian-keygen`.

custodian_agent_user: tegwick
custodian_agent_pubkey: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC/V9fe5MGKdhTBz9KwEvC1NE+HjdoCtQocpGxP6Pko9 custodian-agent"

# ops-bridge tunnel key — injected by the base role so ops-bridge connectivity
# is available as early as SSH infrastructure is up.
# Private key lives at ~/.ssh/id_ops on the workstation. Never commit the private key.
ops_bridge_user: tegwick
ops_bridge_pubkey: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKQmXbAVlEa8dzGx8Hk2S7AITpz6sMWdCN0MeMOzL82u ops-bridge@custodian"

# ---------------------------------------------------------------------------
# k3s API firewall (6443/tcp) — tunnel only (ADR-005)
#
# Public allowlist is empty. Reach the API over ops-bridge:
#   bridge up k3s-api-railiance01    # local 16444
#   bridge up k3s-api-coulombcore    # local 16443
#
# Revoked addresses are pruned on a firewall-tagged converge so rotated or
# retired grants do not remain standing. Do not add new public sources here
# without amending ADR-005.
k3s_api_allowed_sources: []

k3s_api_revoked_sources:
  - address: "89.244.90.248"
    comment: "hand grant added 2026-08-12/15; retired by ADR-005"
  - address: "89.244.90.236"
    comment: "rotated ISP lease; retired by ADR-005"
  - address: "89.244.90.255"
    comment: "rotated ISP lease; retired by ADR-005"
  - address: "89.244.90.246"
    comment: "rotated ISP lease, superseded 2026-08-11"
  - address: "85.132.220.102"
    comment: "historic operator address; also the 2026-08-15 workstation lease"

# Single-node clusters need no public VXLAN grant. Set peer addresses here
# only when a second node must exchange Flannel frames (RAIL-BS-WP-0007).
flannel_vxlan_allowed_sources: []

# HostEurope Nydus agent — provider dashboard, root-password reset, backups.
# Required by the VPS platform (hosteurope/260308-dependency-nydus.md).
# Source-restricting it would break the provider; Anywhere is intentional.
ufw_extra_allowed:
  - port: "2224"
    proto: tcp
    comment: "nydus-ex-api dashboard agent"