# Executable S1 host baseline. scripts/baseline_contract.py resolves this model
# into the Ansible hostvars consumed by convergence and Goss verification.
version: "2.0"

defaults:
  packages:
    - apt-transport-https
    - ca-certificates
    - curl
    - git
    - vim
    - htop
    - ufw
    - fail2ban
    - python3
    - python3-venv
  services:
    - fail2ban
    - ssh.socket
  ssh_directives:
    PasswordAuthentication: "no"
    PermitRootLogin: "no"
    PubkeyAuthentication: "yes"
    ChallengeResponseAuthentication: "no"
  user:
    name: tegwick
    shell: /bin/bash
    sudo: NOPASSWD
  security:
    histcontrol: ignorespace
    fail2ban_jails:
      - sshd

profiles:
  ufw-managed:
    services:
      - ufw
    firewall:
      mode: ufw
      managed: true
      verification:
        command: ufw status
        stdout:
          - "Status: active"
          - "OpenSSH.*ALLOW"

  external-firewall:
    services: []
    firewall:
      mode: external
      managed: false
      replacement_control:
        description: >-
          CoulombCore retains its iptables INPUT default-drop policy and
          Plesk-era accept list until that surface is fully declared for UFW.
        owner: railiance-infra
        removal_condition: >-
          Replace this exception after every required listener is declared and
          an attended UFW migration plan proves no availability regression.
      verification:
        command: iptables -S INPUT
        stdout:
          - "^-P INPUT DROP$"