---
# Custom variables ────────────────────────────────────────────────────────────

rootfs: btrfs

username: follie

# See roles/user/defaults/main.yml for a list of accepted shells
usershell: fish

repository: https://mirror.math.princeton.edu/pub/alpinelinux

# Additional kernel command-line parameters
kernel_parameters:
  - init_on_free=1
  - page_alloc.shuffle=1
  - lockdown=integrity

# 'seatd' or 'elogind'
seat_manager: seatd

# busybox's mdev, skarnet's mdevd or eudev's udev
device_manager: mdevd

# Have no effect when seat_manager == 'elogind'
# See use_polkit variable below
polkit: false

# Should be a file name in /usr/share/consolefonts/
console_font: ter-h22b.psf.gz

# 'dnscrypt-proxy' or 'unbound'
dns_resolver: dnscrypt-proxy

dnscrypt:
  adblock: true
  server_names:
    - quad9-doh-ip4-port443-filter-pri
    - quad9-doh-ip6-port443-filter-pri
    - quad9-dnscrypt-ip4-filter-pri
  ephemeral_keys: true
  tls_disable_session_tickets: true
  tls_cipher_suite: [52392, 49199]
  bootstrap_resolvers:
    - 9.9.9.9:53
    - 1.1.1.1:53
  netprobe_address: 9.9.9.9:53
  local_doh:
    enabled: false
    listen_addresses:
      - 127.0.0.1:3012
    path: '/dns-query'
  anonymized_dns: # not compatible with DoH and ODoH servers
    enabled: false
    routes:
      - server_name: '*'
        via:
          - anon-tiarap
          - anon-tiarap-ipv6
          - anon-cs-tokyo
          - anon-cs-sk

unbound_upstream_nameservers:
  - 9.9.9.9@853#dns.quad9.net
  - 149.112.112.112@853#dns.quad9.net
  - 2620:fe::fe@853#dns.quad9.net
  - 2620:fe::9@853#dns.quad9.net

# 'virtlockd' and 'virtlogd' will always be started. Don't list them here
libvirt_daemons:
  - virtinterfaced
  - virtnetworkd
  - virtnodedevd
  - virtqemud
  - virtstoraged

# For libvirt's NAT firewall rules
# IPv6 is optional (https://wiki.gentoo.org/wiki/QEMU/KVM_IPv6_Support)
libvirt_bridges:
  - name: virbr0
    ip4: 192.168.122.0/24

# Public facing network interfaces
# https://wiki.alpinelinux.org/wiki/Configure_Networking
network_interfaces:
  - name: eth0
    ip4_type: dhcp
    ip6_type: auto

# Punching holes on the machine
# 546/UDP (IPv6 link-local client) is hardcoded (opened) so don't specify it here
opened_ports:
  tcp: []
  udp: []

# 'podman' or 'nerdctl'
rootless_container_cli: podman

# Configure waydroid base image
waydroid:
  rom_type: lineage # lineage, bliss
  system_type: VANILLA # FOSS, GAPPS, VANILLA

# Secrets encrypted with ansible-vault ────────────────────────────────────────

password: '{{ vault_password }}'

# Do NOT change these variables ───────────────────────────────────────────────

# elogind needs polkit to function
use_polkit: '{{ (seat_manager == "elogind") | ternary("True", polkit) }}'
