139 lines
3.4 KiB
YAML
139 lines
3.4 KiB
YAML
---
|
|
# Custom variables ────────────────────────────────────────────────────────────
|
|
# NOTE: for variables checked in `reqirements/accepted_variables.yml`, keep them as top-level
|
|
|
|
repository: https://mirror.math.princeton.edu/pub/alpinelinux
|
|
|
|
rootfs: btrfs
|
|
|
|
bootloader: grub
|
|
|
|
initramfs_generator: mkinitfs
|
|
|
|
username: follie
|
|
|
|
usershell: fish
|
|
|
|
seat_manager: seatd
|
|
|
|
dhcp_client: udhcpc
|
|
|
|
# acpid implementation to use when elogind is not present
|
|
acpid_daemon: busybox
|
|
|
|
device_manager: mdevd
|
|
|
|
audit_daemon: auditd
|
|
|
|
crond_provider: cronie
|
|
|
|
syslog_provider: busybox
|
|
|
|
rootless_container_cli: podman
|
|
|
|
# Additional kernel command-line parameters (added to the bootloader)
|
|
additional_kernel_parameters:
|
|
- init_on_free=1
|
|
- page_alloc.shuffle=1
|
|
- lockdown=integrity
|
|
|
|
ntp_client: ntpsec
|
|
ntp_options:
|
|
pool: # https://www.ntppool.org/en/use.html
|
|
- 0.pool.ntp.org
|
|
- 1.pool.ntp.org
|
|
- 2.pool.ntp.org
|
|
- 3.pool.ntp.org
|
|
|
|
dns_resolver: dnscrypt-proxy
|
|
dnscrypt:
|
|
adblock: true
|
|
server_names:
|
|
- quad9-doh-ip4-port443-filter-pri
|
|
- quad9-doh-ip6-port443-filter-pri
|
|
- quad9-dnscrypt-ip4-filter-pri
|
|
- cloudflare-security
|
|
- cloudflare-security-ipv6
|
|
ephemeral_keys: true
|
|
tls_disable_session_tickets: true
|
|
tls_cipher_suite: [52392, 49199]
|
|
bootstrap_resolvers:
|
|
- 9.9.9.9:53
|
|
- 1.1.1.1:53
|
|
netprobe_address: 1.1.1.1:53
|
|
local_doh:
|
|
enabled: false
|
|
listen_addresses:
|
|
- 127.0.0.1:3012
|
|
path: '/dns-query'
|
|
anonymized_dns: # not compatible with DoH and ODoH servers
|
|
enabled: false
|
|
routes:
|
|
- server_name: '*'
|
|
via:
|
|
- anon-tiarap
|
|
- anon-tiarap-ipv6
|
|
- anon-cs-tokyo
|
|
- anon-cs-sk
|
|
unbound_upstream_nameservers:
|
|
- 9.9.9.9@853#dns.quad9.net
|
|
- 149.112.112.112@853#dns.quad9.net
|
|
- 2620:fe::fe@853#dns.quad9.net
|
|
- 2620:fe::9@853#dns.quad9.net
|
|
- 1.1.1.1@853#cloudflare-dns.com
|
|
- 1.0.0.1@853#cloudflare-dns.com
|
|
- 2606:4700:4700::1111@853#cloudflare-dns.com
|
|
- 2606:4700:4700::1001@853#cloudflare-dns.com
|
|
|
|
# Enable/Disable access to /sys/firmware/efi/efivars
|
|
disable_uefi_access: true
|
|
|
|
# Should polkit be used
|
|
# (have no effect when seat_manager == 'elogind')
|
|
polkit: false
|
|
|
|
# Should be a file name in /usr/share/consolefonts/
|
|
console_font: ter-h22b.psf.gz
|
|
|
|
# 'virtlockd' and 'virtlogd' will always be started so don't list them here
|
|
libvirt_daemons:
|
|
- virtinterfaced
|
|
- virtnetworkd
|
|
- virtnodedevd
|
|
- virtqemud
|
|
- virtstoraged
|
|
|
|
# For libvirt's NAT firewall rules
|
|
# IPv6 is optional (https://wiki.gentoo.org/wiki/QEMU/KVM_IPv6_Support)
|
|
libvirt_bridges:
|
|
- name: virbr0
|
|
ip4: 192.168.122.0/24
|
|
|
|
# Public facing network interfaces
|
|
# https://wiki.alpinelinux.org/wiki/Configure_Networking
|
|
network_interfaces:
|
|
- name: eth0
|
|
ip4_type: dhcp
|
|
ip6_type: auto
|
|
|
|
# Punching holes on the machine
|
|
# 546/UDP (IPv6 link-local client) is hardcoded (opened) so don't specify it here
|
|
opened_ports:
|
|
tcp: []
|
|
udp: []
|
|
|
|
# earlyoom kills processes on its own so make it optional
|
|
earlyoom:
|
|
set_priority: true
|
|
mem_min_percent: 5,2
|
|
swap_min_percent: 10,5
|
|
|
|
# Configure waydroid base image
|
|
waydroid:
|
|
rom_type: lineage # lineage, bliss
|
|
system_type: VANILLA # FOSS, GAPPS, VANILLA
|
|
|
|
# Secrets encrypted with ansible-vault ────────────────────────────────────────
|
|
|
|
password: '{{ vault_password }}'
|