new_user: counterweight
ssh_port: 22
allow_ssh_from: "any"
root_domain: contrapeso.xyz

# Uptime Kuma was decommissioned on 2026-09-11. The monitoring blocks in the
# playbooks are kept deliberately — the check logic is meant to be rewired to
# whatever replaces it. This flag keeps them inert until then. See archive/uptime_kuma/.

# age recipient for all backup artefacts
age_backup_recipient: "age192wwdaseqej2ggwyp884gtm05c396anp7chr0vr8m47g50fahpyqr9fsza"

# Public key small-backups-box pulls with
# Authorised on each source host for an unprivileged, dedicated user only
backup_pull_public_key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOfIixKMhA9z+Nvyx6ToZIniC8aEgyiInRiboaTTemgX offsite-backup-pull"


# ─────────────────────────────────────────────────────────────────────────────
# Subdomains. Global because the edge host proxies for services that live on
# other machines, so no single inventory group covers the readers. Combine with
# root_domain above to build an FQDN.
#
# Moved here from services_config.yml, which 30 plays had to remember to name in
# vars_files: - a file everyone must opt into is a file someone will forget.
# ─────────────────────────────────────────────────────────────────────────────
subdomains:
  # Monitoring
  gatus: status
  ntfy: ntfy

  # VPN infrastructure (spacey)
  headscale: headscale

  # Core services (vipy)
  vaultwarden: vault
  forgejo: forgejo
  lnbits: wallet

  # Secondary services (vipy)
  ntfy_emergency_app: avisame
  personal_blog: pablohere

  # Memos (memos-box)
  memos: memos

  # Mempool block explorer (mempool-box, proxied via vipy)
  mempool: mempool

  # DATUM Gateway dashboard (knots-box, proxied via vipy)
  datum_gateway: datum

# Read by plays targeting managed, monitoring, vpn_control and edge - no one
# group covers them, so these are global rather than group_vars/<group>.
ntfy_topic: alerts
headscale_namespace: counter-net

# ─────────────────────────────────────────────────────────────────────────────
# Domains whose registration expiry is monitored (infra/402_public_monitoring).
#
# Registration renewal is a manual act at the registrar, and losing a domain is
# not recoverable in the way losing a host is - so these are checked daily and
# alarm with two weeks of runway.
#
# root_domain is the estate's own domain; the rest are domains we own that are
# served from it or from a host in the inventory.
# ─────────────────────────────────────────────────────────────────────────────
monitored_domains:
  - "{{ root_domain }}"
  - arbret.com