config.yml.sample

---

####################
# General settings #
####################

general:
  # Set the hostname of the server
  hostname: homeserver

  # Web domain name of the server
  domain: homeserver.example.com

  # Set the timezone
  timezone: Etc/UTC

  # Configure which package updates are installed automatically
  # If set to "security", only security updates will be installed
  # If set to "all", all updates will be installed
  # If set to "none", no updates will be installed
  auto_update_packages: security

  # DNS servers to use for non-local lookups
  upstream_dns_servers:
    - '1.1.1.1'
    - '1.0.0.1'
    - '2606:4700:4700::1111'
    - '2606:4700:4700::1001'

users:
  worker: worker
  nas: nas


####################
# Storage settings #
####################

storage:

  # Directory in which application data will be stored
  data_dir: /data

  # Directory in which NAS will be mounted
  nas_dir: /nas

  # Directory for Docker images
  docker_dir: /var/lib/docker

  # Define LVM volumes
  vg: pool
  volumes:
    root:
      mount: /
      size: 64G
      fs: ext4

    nas:
      mount: /nas
      size: 50G
      fs: ext4

    data:
      mount: /data
      size: 100G
      fs: ext4


################
# DDNS options #
################

ddns_enabled: no

# Cloudflare zone to which the server's domain belongs
ddns_cloudflare_zone: example.com

# This token requires the Zone/Zone/Read permission for all zones, and
# Zone/DNS/Edit permission for the zone containing the domain for the server.
ddns_cloudflare_api_token: <your_cloudflare_api_token>


######################
# DNS server options #
######################

dnsmasq_enabled: yes

dnsmasq_custom_hosts:
  - name: "{{ general.domain }}"
    ip: "{{ ansible_default_ipv4.address }}"
  - name: ".{{ general.domain }}"
    ip: "{{ ansible_default_ipv4.address }}"

#################
# Samba options #
#################

# See https://github.com/vladgh/ansible-collection-vladgh-samba
samba_guest_account: "{{ users.nas }}"
samba_shares_root: "{{ storage.nas_dir }}"
samba_manage_directories: no
samba_netbios_name: "{{ general.hostname | split('.') | first }}"
samba_server_string: Home NAS

# Just run as a standalone SMB server, not a WINS or AD server
samba_wins_support: no
samba_domain_master: no
samba_preferred_master: no
samba_local_master: yes

# Treat unknown users as guests, but treat bad passwords as errors.
# See https://www.samba.org/samba/docs/current/man-html/smb.conf.5.html
samba_map_to_guest: Bad User

samba_shares:
  - name: Dump
    comment: A place for files to go
    public: yes
    writeable: yes

  - name: Media
    comment: Media to be streamed using Jellyfin
    public: yes
    writable: yes


############################
# Minecraft server options #
############################

minecraft_server_enabled: yes
minecraft_server_env:
  # Server properties
  SERVER_PORT: "25565"
  ENFORCE_SECURE_PROFILE: "false"
  ONLINE_MODE: "true"
  ENABLE_COMMAND_BLOCK: "true"
  ENABLE_QUERY: "true"

  # Enable automatically pausing when nobody is online
  EXEC_DIRECTLY: "false"
  ENABLE_AUTOPAUSE: "true"
  MAX_TICK_TIME: "-1"  # See https://docker-minecraft-server.readthedocs.io/en/latest/misc/autopause-autostop/autopause/
  AUTOPAUSE_TIMEOUT_EST: "600"  # Pause 10 minutes after last player disconnects
  AUTOPAUSE_TIMEOUT_INIT: "60"  # Pause 1 minute after startup if inactive

  # Server settings
  TYPE: fabric
  VERSION: "1.20.4"
  INIT_MEMORY: "512M"
  MAX_MEMORY: "1G"

######################
# Authentik settings #
######################

# After Authentik is enabled, go to https://<hostname>:9443/if/flow/initial-setup/
authentik_enabled: yes

# Traefik routing options for Authentik
authentik_routing:
  enabled: true
  subdomain: authentik

# See https://docs.goauthentik.io/docs/installation/configuration for documentation.
# Use Ansible Vault to encrypt the secret_* variables.
authentik_env:
  # PostgreSQL root password
  PG_PASS: "{{ secret_authentik_pg_pass }}"

  # Credentials for the Authentik "akadmin" user during initial setup.
  # Use Ansible Vault to store an encrypted password here.
  AUTHENTIK_BOOTSTRAP_EMAIL: "{{ secret_authentik_bootstrap_email }}"
  AUTHENTIK_BOOTSTRAP_PASSWORD: "{{ secret_authentik_bootstrap_password }}"


####################
# Traefik settings #
####################

traefik_enabled: yes

traefik_ports:
  http: 80
  https: 443
  metrics: 8090

# See https://doc.traefik.io/traefik/https/acme/ for information on how to
# configure the provider and environment variables.
traefik_acme_dns:
  enabled: no
  provider: cloudflare

  # Email for Let's Encrypt, used to receive expiry notifications.
  # This doesn't need to be encrypted, but doing so hides it from bots scraping
  # GitHub for credentials.
  email: <your_email>

  # This is sensitive and must be encrypted, e.g. using Ansible Vault.
  env:
    # This API token needs Zone/Zone/Read permissions for all zones, and
    # Zone/DNS/Edit permissions for the zone containing the domain for the
    # server.
    CF_DNS_API_TOKEN: <your_cloudflare_api_token>


######################
# Tailscale settings #
######################

tailscale_enabled: false

# Subnets to route traffic to
tailscale_routes:
  - "10.0.0.0/24"

# Use Ansible Vault to put your encrypted auth key here
tailscale_auth_key: "{{ undef() }}"


###################
# Homarr settings #
###################

homarr_enabled: true
homarr_routing:
  enabled: true
  homepage: true

# OIDC settings for Authentik
homarr_env:
  AUTH_PROVIDER: oidc
  AUTH_OIDC_CLIENT_NAME: Authentik
  AUTH_OIDC_CLIENT_ID: "{{ secret_homarr_oidc_client_id }}"
  AUTH_OIDC_CLIENT_SECRET: "{{ secret_homarr_oidc_client_secret }}"
  AUTH_OIDC_SCOPE_OVERWRITE: openid email profile groups
  AUTH_OIDC_ADMIN_GROUP: Administrators
  AUTH_OIDC_URI: >-
    https://{{ authentik_routing.subdomain | default('auth') }}.{{ general.domain }}/application/o/homarr
  AUTH_LOGOUT_REDIRECT_URL: >-
    https://{{ authentik_routing.subdomain | default('auth') }}.{{ general.domain }}/application/o/homarr/end-session/


##################
# Minio settings #
##################

minio_enabled: true

minio_routing:
  enabled: true
  api_subdomain: s3
  ui_subdomain: minio

# Use Ansible Vault to put your encrypted credentials here
minio_root_user: "{{ undef() }}"
minio_root_password: "{{ undef() }}"

# Environment variables to configure integration with Authentik using OpenID Connect.
# Currently, this requires manual setup in the Authentik UI.
# Use Ansible Vault to put your encrypted client ID and secret below.
minio_env:
  MINIO_IDENTITY_OPENID_CONFIG_URL: "https://{{ authentik_routing.subdomain | default('auth') }}.{{ general.domain }}\
    /application/o/minio/.well-known/openid-configuration"
  MINIO_IDENTITY_OPENID_CLIENT_ID: "{{ secret_minio_openid_client_id }}"
  MINIO_IDENTITY_OPENID_CLIENT_SECRET: "{{ secret_minio_openid_client_secret }}"
  MINIO_IDENTITY_OPENID_CLAIM_NAME: policy
  MINIO_IDENTITY_OPENID_DISPLAY_NAME: Log in with Authentik
  MINIO_IDENTITY_OPENID_SCOPES: openid,profile,email,minio
  MINIO_IDENTITY_OPENID_REDIRECT_URI: >-
    {{ minio_routing.ui_subdomain | default('minio') }}.{{ general.domain }}/oauth_callback
  MINIO_IDENTITY_OPENID_REDIRECT_URI_DYNAMIC: "on"
  MINIO_IDENTITY_OPENID_CLAIM_USERINFO: "on"
  MINIO_IDENTITY_OPENID_COMMENT: "Authentik"


######################
# Bitwarden settings #
######################

bitwarden_enabled: true


#####################
# Jellyfin settings #
#####################

jellyfin_enabled: yes

jellyfin_enable_vaapi: false

jellyfin_admin_username: "{{ secret_jellyfin_admin_username }}"
jellyfin_admin_password: "{{ secret_jellyfin_admin_password }}"

jellyfin_oidc_client_id: "{{ secret_jellyfin_oidc_client_id }}"
jellyfin_oidc_client_secret: "{{ secret_jellyfin_oidc_client_secret }}"


#######################
# Monitoring settings #
#######################

monitoring_enabled: yes

monitoring_prometheus_routing_private: yes
monitoring_grafana_routing_private: no

# Grafana SSO settings
monitoring_grafana_sso: yes
monitoring_grafana_sso_only: yes
monitoring_grafana_client_id: "{{ secret_monitoring_grafana_client_id }}"
monitoring_grafana_client_secret: "{{ secret_monitoring_grafana_client_secret }}"


############################
# Healthchecks.io settings #
############################

healthchecksio_enabled: no

# vim: ft=yaml