new_user: counterweight
ssh_port: 22
allow_ssh_from: "any"
root_domain: contrapeso.xyz

# Uptime Kuma was decommissioned on 2026-09-11. The monitoring blocks in the
# playbooks are kept deliberately — the check logic is meant to be rewired to
# whatever replaces it. This flag keeps them inert until then. See archive/uptime_kuma/.
uptime_kuma_enabled: false

# age recipient for all backup artefacts
age_backup_recipient: "age192wwdaseqej2ggwyp884gtm05c396anp7chr0vr8m47g50fahpyqr9fsza"

# Public key small-backups-box pulls with
# Authorised on each source host for an unprivileged, dedicated user only
backup_pull_public_key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOfIixKMhA9z+Nvyx6ToZIniC8aEgyiInRiboaTTemgX offsite-backup-pull"


# ─────────────────────────────────────────────────────────────────────────────
# Subdomains. Global because the edge host proxies for services that live on
# other machines, so no single inventory group covers the readers. Combine with
# root_domain above to build an FQDN.
#
# Moved here from services_config.yml, which 30 plays had to remember to name in
# vars_files: - a file everyone must opt into is a file someone will forget.
# ─────────────────────────────────────────────────────────────────────────────
subdomains:
  # Monitoring
  gatus: status
  ntfy: ntfy
  # Uptime Kuma IS still running and this subdomain DOES resolve
  # (164.92.239.72, HTTP 302). Only the Ansible code and the vault credentials
  # were retired. A comment here previously claimed the opposite.
  uptime_kuma: uptime

  # VPN infrastructure (spacey)
  headscale: headscale

  # Core services (vipy)
  vaultwarden: vault
  forgejo: forgejo
  lnbits: wallet

  # Secondary services (vipy)
  ntfy_emergency_app: avisame
  personal_blog: pablohere

  # Memos (memos-box)
  memos: memos

  # Mempool block explorer (mempool-box, proxied via vipy)
  mempool: mempool

  # DATUM Gateway dashboard (knots-box, proxied via vipy)
  datum_gateway: datum

# Read by plays targeting managed, monitoring, vpn_control and edge - no one
# group covers them, so these are global rather than group_vars/<group>.
ntfy_topic: alerts
headscale_namespace: counter-net