2022-01-14 19:46:59 +01:00
|
|
|
---
|
2023-04-05 19:00:00 +02:00
|
|
|
# Choices of components ────────────────────────────────────────────────────────────
|
|
|
|
# NOTE: verified with `reqirements/accepted_variables.yml`, so keep them as top-level
|
2022-02-11 18:39:35 +01:00
|
|
|
|
2022-10-16 12:31:57 +02:00
|
|
|
snapshot_tool: btrbk
|
|
|
|
|
2022-10-01 16:15:29 +02:00
|
|
|
initramfs_generator: mkinitfs
|
2022-02-11 18:39:35 +01:00
|
|
|
|
2022-10-01 16:15:29 +02:00
|
|
|
usershell: fish
|
2022-08-21 10:47:03 +02:00
|
|
|
|
2022-02-11 18:39:35 +01:00
|
|
|
seat_manager: seatd
|
|
|
|
|
2022-10-01 16:15:29 +02:00
|
|
|
dhcp_client: udhcpc
|
|
|
|
|
2022-08-07 11:33:21 +02:00
|
|
|
# acpid implementation to use when elogind is not present
|
|
|
|
acpid_daemon: busybox
|
|
|
|
|
2023-04-05 19:00:00 +02:00
|
|
|
device_manager: udev
|
2022-05-20 18:55:40 +02:00
|
|
|
|
2022-10-01 16:15:29 +02:00
|
|
|
crond_provider: cronie
|
2022-02-17 17:33:22 +01:00
|
|
|
|
2022-10-01 16:15:29 +02:00
|
|
|
syslog_provider: busybox
|
2022-06-19 20:27:32 +02:00
|
|
|
|
2022-10-01 16:15:29 +02:00
|
|
|
ntp_client: ntpsec
|
|
|
|
|
|
|
|
dns_resolver: dnscrypt-proxy
|
2023-04-05 19:00:00 +02:00
|
|
|
|
|
|
|
# Configurations ───────────────────────────────────────────────────────────────────
|
|
|
|
|
|
|
|
repository: https://ftp.udx.icscoe.jp/Linux/alpine
|
|
|
|
|
|
|
|
rootfs: btrfs
|
|
|
|
|
|
|
|
username: follie
|
|
|
|
|
|
|
|
# Don't specify "seat" or "polkitd" group here
|
|
|
|
usergroups: [wheel, input, audio, video, libvirt, users, pipewire]
|
|
|
|
|
|
|
|
# Public NTP pools: https://www.ntppool.org/en/use.html
|
|
|
|
# Public NTS-enabled servers: https://github.com/jauderho/nts-servers
|
|
|
|
ntp_opts:
|
|
|
|
# NOTE: peer option isn't available in ntpsec.
|
|
|
|
# Also, we are just the NTP client => no need to exchange time with anyone
|
|
|
|
pools: []
|
|
|
|
servers:
|
|
|
|
- time.cloudflare.com
|
|
|
|
- ntpmon.dcs1.biz
|
|
|
|
- nts.netnod.se
|
|
|
|
- ntp.zeitgitter.net
|
|
|
|
- virginia.time.system76.com
|
|
|
|
- ntp3.fau.de
|
|
|
|
- gps.ntp.br
|
|
|
|
# include 'nts' option on each server directive (common NTP pools don't support NTS yet)
|
|
|
|
nts_enabled: true
|
|
|
|
|
2022-06-19 20:27:32 +02:00
|
|
|
dnscrypt:
|
|
|
|
adblock: true
|
|
|
|
server_names:
|
|
|
|
- quad9-doh-ip4-port443-filter-pri
|
|
|
|
- quad9-doh-ip6-port443-filter-pri
|
|
|
|
- quad9-dnscrypt-ip4-filter-pri
|
2022-07-19 17:36:13 +02:00
|
|
|
- cloudflare-security
|
|
|
|
- cloudflare-security-ipv6
|
2022-06-19 20:27:32 +02:00
|
|
|
ephemeral_keys: true
|
|
|
|
tls_disable_session_tickets: true
|
|
|
|
tls_cipher_suite: [52392, 49199]
|
2023-04-05 19:00:00 +02:00
|
|
|
bootstrap_resolvers: [9.9.9.9:53, 1.1.1.1:53]
|
2022-07-19 17:36:13 +02:00
|
|
|
netprobe_address: 1.1.1.1:53
|
2022-06-19 20:27:32 +02:00
|
|
|
local_doh:
|
|
|
|
enabled: false
|
2023-04-05 19:00:00 +02:00
|
|
|
listen_addresses: [127.0.0.1:3012]
|
2022-06-19 20:27:32 +02:00
|
|
|
path: '/dns-query'
|
|
|
|
anonymized_dns: # not compatible with DoH and ODoH servers
|
|
|
|
enabled: false
|
|
|
|
routes:
|
|
|
|
- server_name: '*'
|
|
|
|
via:
|
|
|
|
- anon-tiarap
|
|
|
|
- anon-tiarap-ipv6
|
|
|
|
- anon-cs-tokyo
|
|
|
|
- anon-cs-sk
|
2023-04-05 19:00:00 +02:00
|
|
|
|
2022-01-28 17:43:31 +01:00
|
|
|
unbound_upstream_nameservers:
|
|
|
|
- 9.9.9.9@853#dns.quad9.net
|
|
|
|
- 149.112.112.112@853#dns.quad9.net
|
|
|
|
- 2620:fe::fe@853#dns.quad9.net
|
|
|
|
- 2620:fe::9@853#dns.quad9.net
|
2022-07-19 17:36:13 +02:00
|
|
|
- 1.1.1.1@853#cloudflare-dns.com
|
|
|
|
- 1.0.0.1@853#cloudflare-dns.com
|
|
|
|
- 2606:4700:4700::1111@853#cloudflare-dns.com
|
|
|
|
- 2606:4700:4700::1001@853#cloudflare-dns.com
|
2022-01-14 19:46:59 +01:00
|
|
|
|
2022-10-01 16:15:29 +02:00
|
|
|
# Enable/Disable access to /sys/firmware/efi/efivars
|
2023-04-05 19:00:00 +02:00
|
|
|
disable_uefi_access: false
|
2022-10-01 16:15:29 +02:00
|
|
|
|
|
|
|
# Should polkit be used
|
2023-04-05 19:00:00 +02:00
|
|
|
# NOTE: have no effect when seat_manager == 'elogind'
|
2022-10-01 16:15:29 +02:00
|
|
|
polkit: false
|
|
|
|
|
2023-04-05 19:00:00 +02:00
|
|
|
# Should be a file name existed inside /usr/share/consolefonts/
|
2022-10-01 16:15:29 +02:00
|
|
|
console_font: ter-h22b.psf.gz
|
|
|
|
|
|
|
|
# 'virtlockd' and 'virtlogd' will always be started so don't list them here
|
2022-02-11 18:39:35 +01:00
|
|
|
libvirt_daemons:
|
|
|
|
- virtinterfaced
|
|
|
|
- virtnetworkd
|
|
|
|
- virtnodedevd
|
|
|
|
- virtqemud
|
|
|
|
- virtstoraged
|
|
|
|
|
2022-11-20 13:05:41 +01:00
|
|
|
# Whether to use `iwd` or `eiwd`
|
|
|
|
iwd_without_dbus: false
|
|
|
|
|
2022-11-05 05:21:19 +01:00
|
|
|
# Public facing network interfaces to configured
|
2023-02-18 18:48:37 +01:00
|
|
|
# - ip4_addr, ip6_addr should include netmask (e.g. 192.168.1.10/24)
|
|
|
|
# - don't include wireless interfaces here as they should use dhcp with iwctl
|
|
|
|
# - udhcpc: https://wiki.alpinelinux.org/wiki/Configure_Networking
|
2022-04-04 08:27:06 +02:00
|
|
|
network_interfaces:
|
|
|
|
- name: eth0
|
|
|
|
ip4_type: dhcp
|
|
|
|
ip6_type: auto
|
|
|
|
|
2022-05-10 18:13:35 +02:00
|
|
|
# Punching holes on the machine
|
2022-04-04 08:27:06 +02:00
|
|
|
# 546/UDP (IPv6 link-local client) is hardcoded (opened) so don't specify it here
|
|
|
|
opened_ports:
|
|
|
|
tcp: []
|
|
|
|
udp: []
|
|
|
|
|
2022-07-23 13:43:38 +02:00
|
|
|
# earlyoom kills processes on its own so make it optional
|
|
|
|
earlyoom:
|
|
|
|
set_priority: true
|
|
|
|
mem_min_percent: 5,2
|
|
|
|
swap_min_percent: 10,5
|
|
|
|
|
2023-04-05 19:00:00 +02:00
|
|
|
# auditd by default rotates its logfile when reaching file size limit
|
|
|
|
auditd_logrotate_daily: false
|
|
|
|
|
2022-02-14 06:55:43 +01:00
|
|
|
# Secrets encrypted with ansible-vault ────────────────────────────────────────
|
|
|
|
|
2022-02-11 18:39:35 +01:00
|
|
|
password: '{{ vault_password }}'
|