---
# Host-specific configuration for netbox.vntx.net.
# Connection
ansible_host: 204.110.191.243
ansible_python_interpreter: /usr/bin/python3
ansible_ssh_common_args: '-o StrictHostKeyChecking=accept-new'

# This host's network is configured out of band; don't let the general role
# clobber it.
network:
  skip: true

# Public-facing reverse proxy + SSH-from-LAN — mirrors the live ufw rules.
firewall_allow_rules:
  - port: 80
    proto: tcp
    comment: HTTP
  - port: 443
    proto: tcp
    comment: HTTPS

# ---- netbox role overrides ----
netbox_admins:
  - name: "Graham McIntire"
    email: "graham@vntx.net"

netbox_allowed_hosts:
  - netbox.vntx.net

netbox_caddy_domain: netbox.vntx.net
netbox_login_required: true

# Secrets — pull from a vault file alongside this one (host_vars/netbox.vntx.net/vault.yml,
# encrypted with ansible-vault). The role asserts these are set before rendering config.
netbox_secret_key: "{{ vault_netbox_secret_key }}"
netbox_db_password: "{{ vault_netbox_db_password }}"
netbox_api_token_peppers: "{{ vault_netbox_api_token_peppers | default({}) }}"