---
# Base role defaults.

# Source addresses permitted to reach the k3s API (6443/tcp).
#
# WHY THIS EXISTS
# ---------------
# The k3s API was originally opened to Anywhere by this role, and the source
# restriction was later added by hand on the live host. That left the declared
# config WEAKER than reality: re-running this role would have removed the
# restriction and exposed the Kubernetes API to the internet. Found 2026-08-11.
#
# The allowlist is therefore declared here and converged, not hand-edited.
#
# Deliberately empty by default. A host that sets no sources gets NO public
# access to 6443 — which is the safe failure. SSH (22) is unaffected, so a host
# converged with an empty list is always recoverable.
#
# Set the real values in inventory/group_vars/all.yaml. Each entry:
#   - address: "203.0.113.10"
#     comment: "k3s-api-operator-workstation"
k3s_api_allowed_sources: []

# Source addresses whose k3s API access must be REMOVED on convergence.
#
# Operator addresses rotate (dynamic ISP leases). Without this, every rotation
# leaves a standing grant to an address the ISP has since reassigned to someone
# else. Move an address here when it stops being yours; convergence then prunes
# it rather than leaving it to accumulate.
k3s_api_revoked_sources: []