---
#
# Use the apt proxy
#
use_apt_proxy: False

pkg_state: installed
common_packages:
  - acl
  - zile
  - dstat
  - iotop
  - curl
  - wget
  - vim-tiny
  - psmisc
  - tcpdump
  - lsof
  - strace
  - rsync
  - multitail
  - unzip
  - htop
  - tree
  - bind9-host
  - bash-completion
  - sudo
  - apt-transport-https
  - nano
  - xmlstarlet

# Set this variable in your playbook
# additional_packages:
#   - pkg1
#   - pkg2

# Unattended upgrades
unatt_allowed_origins:
  - '${distro_id}:${distro_codename}-security'
#unatt_blacklisted:
#  - libc6
unatt_autofix: "true"
# When true, the procedure is really slow
unatt_minimalsteps: "false"
unatt_install_on_shutdown: "false"
#unatt_email: sysadmin@isti.cnr.it
unatt_email_on_error: "false"
unatt_autoremove: "true"
unatt_autoreboot: "false"
unatt_autoreboot_time: "now"

#
# Defaults
#
cleanup_base_packages: True
base_packages_to_remove:
  - ppp
  - at

cleanup_x_base_packages: False
x_base_packages_to_remove:
  - firefox-locale-en
  - x11-common

cleanup_nfs_packages: False
nfs_packages:
  - nfs-common
  - portmap

cleanup_rpcbind_packages: False
rpcbind_packages:
  - rpcbind

cleanup_exim_email_server: True
exim_email_server_pkgs:
  - exim4
  - exim4-base
  - exim4-config
  - exim4-daemon-light

disable_some_not_needed_services: False
services_to_be_disabled:
  - rpcbind
  - atd
  - acpid

# A generic PKI directory where the local certificates will be stored
pki_dir: /etc/pki
pki_subdirs:
  - certs
  - keys
  
disable_ipv6: True
ipv6_sysctl_value: 1
ipv6_sysctl_file: /etc/sysctl.d/10-ipv6-disable.conf

# Install our /etc/resolv.conf
install_resolvconf: True

# Install and configure munin
configure_munin: False

# Manage the root ssh keys
manage_root_ssh_keys: False

install_additional_ca_certs: False
additional_ca_dest_dir: /usr/local/share/ca-certificates
# IMPORTANT: the destination file extension must be .crt
#x509_additional_ca_certs:
#  - { url: "https://security.fi.infn.it/CA/mgt/INFNCA.pem", dest_file: '{{ additional_ca_dest_dir }}/infn-ca.crt' }

#
default_security_limits:
  - { domain: 'root', l_item: 'nofile', type: 'soft', value: '8192' }
  - { domain: 'root', l_item: 'nofile', type: 'hard', value: '8192' }


#
# debian/ubuntu distributions controllers
#
has_default_grub: "'{{ ansible_distribution }}' == 'Debian' and '{{ ansible_distribution_version }}' != 'lenny/sid' and {{ ansible_distribution_major_version }} >= 6"

has_htop: "'{{ ansible_distribution }}' == 'Ubuntu' and ({{ ansible_distribution_version }} == 10.10 or {{ ansible_distribution_version }} == 11.04 or {{ ansible_distribution_version }} == 12.04)"

has_apt: "('{{ ansible_distribution }}' == 'Debian' or '{{ ansible_distribution }}' == 'Ubuntu') and '{{ ansible_distribution_version }}' != 'lenny/sid' and '{{ ansible_distribution_major_version }}' >= 5"

has_fail2ban: "(('{{ ansible_distribution }}' == 'Ubuntu') and ({{ ansible_distribution_major_version }} >= 14)) or (('{{ ansible_distribution }}' == 'Debian') and ({{ ansible_distribution_major_version }} >= 8))"

is_debian: "'{{ ansible_distribution }}' == 'Debian'"
is_debian8: "'{{ ansible_distribution_release }}' == 'jessie'"
is_debian7: "'{{ ansible_distribution_release }}' == 'wheezy'"
is_debian6: "('{{ ansible_distribution }}' == 'Debian' and {{ ansible_distribution_major_version }} == 6)"
is_debian5: "'{{ ansible_distribution }}' == 'Debian' and '{{ ansible_distribution_version }}' != 'lenny/sid' and {{ ansible_distribution_major_version }} == 5"
is_debian4: "'{{ ansible_distribution }}' == 'Debian' and '{{ ansible_distribution_version }}' != 'lenny/sid' and {{ ansible_distribution_major_version }} == 4"
is_not_debian6: "'{{ ansible_distribution }}' == 'Debian' and '{{ ansible_distribution_version }}' != 'lenny/sid' and {{ ansible_distribution_major_version }} != 6"
is_debian_7_or_older: "'{{ ansible_distribution }}' == 'Debian' and {{ ansible_distribution_major_version }} <= 7"
is_debian_less_than6: "'{{ ansible_distribution }}' == 'Debian' and '{{ ansible_distribution_version }}' != 'lenny/sid' and {{ ansible_distribution_major_version }} < 6"
is_not_debian_less_than_6: "('{{ ansible_distribution }}' != 'Debian') or (('{{ ansible_distribution }}' == 'Debian' or '{{ ansible_distribution }}' == 'Ubuntu') and '{{ ansible_distribution_version }}' != 'lenny/sid' and {{ ansible_distribution_major_version }} >= 6)"
is_not_debian_less_than_7: "('{{ ansible_distribution }}' != 'Debian') or (('{{ ansible_distribution }}' == 'Debian' or '{{ ansible_distribution }}' == 'Ubuntu') and '{{ ansible_distribution_version }}' != 'lenny/sid' and {{ ansible_distribution_major_version }} >= 7)"

is_hardy: "'{{ ansible_distribution_release }}' == 'hardy'"
is_broken_hardy_lts: "'{{ ansible_distribution }}'== 'Debian' and '{{ ansible_distribution_release }}' == 'NA'"
is_jaunty: "'{{ ansible_distribution_release }}' == 'jaunty'"
is_quantal: "'{{ ansible_distribution_release }}' == 'quantal'"
is_natty: "'{{ ansible_distribution_release }}' == 'natty'"
is_precise: "'{{ ansible_distribution_release }}' == 'precise'"
is_trusty: "'{{ ansible_distribution_release }}' == 'trusty'"
is_ubuntu: "'{{ ansible_distribution }}' == 'Ubuntu'"
is_not_precise: "('{{ ansible_distribution }}' == 'Ubuntu' and {{ ansible_distribution_version }} != 12.04) or '{{ ansible_distribution }}' == 'Debian'"
is_not_trusty: "('{{ ansible_distribution }}' == 'Ubuntu' and {{ ansible_distribution_version }} != 14.04) or '{{ ansible_distribution }}' == 'Debian'"
is_not_ubuntu_less_than_precise: "('{{ ansible_distribution }}' == 'Ubuntu') and ({{ ansible_distribution_major_version }} >= 12)"
is_not_ubuntu_less_than_trusty: "('{{ ansible_distribution }}' == 'Ubuntu') and ({{ ansible_distribution_major_version }} >= 14)"
is_ubuntu_less_than_precise: "('{{ ansible_distribution }}' == 'Ubuntu') and ({{ ansible_distribution_major_version }} < 12)"
is_ubuntu_less_than_trusty: "('{{ ansible_distribution }}' == 'Ubuntu') and ({{ ansible_distribution_major_version }} < 14)"
# Ubuntu < 10.04 or Debian 4
is_ubuntu_between_8_and_9_and_is_debian_4: "('{{ ansible_distribution }}' == 'Ubuntu' and ({{ ansible_distribution_version }} == 8.04 or {{ ansible_distribution_version }} == 8.10 or {{ ansible_distribution_version }} == 9.04)) or ({{ is_debian4 }})"
#is_ubuntu_between_8_and_9_or_is_debian_4: "('{{ ansible_distribution }}' == 'Ubuntu') and ({{ ansible_distribution_major_version }} < 12) or ({{ is_debian4 }})"
is_ubuntu_between_8_and_9_or_is_debian_4: "'{{ is_ubuntu_between_8_and_9_and_is_debian_4 }}'"
# Ubuntu between 10.04 and 11.04
is_ubuntu_between_10_04_and_11_04: "'{{ ansible_distribution }}' == 'Ubuntu' and ({{ ansible_distribution_version }} == 10.04 or {{ ansible_distribution_version }} == 10.10 or {{ ansible_distribution_version }} == 11.04)"
# Ubuntu between 10.04 and 11.04, or Debian 6
is_ubuntu_between_10_04_and_11_04_and_is_debian_6: "({{ is_ubuntu_between_10_04_and_11_04 }} or {{ is_debian6 }})"
# Debian >=6
is_debian_greater_than_5: "'{{ ansible_distribution }}' == 'Debian' and '{{ ansible_distribution_version }}' != 'lenny/sid' and {{ ansible_distribution_major_version }} >= 6"

is_trusty_or_debian7: "('{{ ansible_distribution_release }}' == 'trusty') or ('{{ ansible_distribution_release }}' == 'wheezy')"