Initialise repository structure and placeholder files. Generic functionality works i guess, need to come up with a better solution for compose templates

group_vars/README.md

@@ -0,0 +1,9 @@
+# Group Variables
+
+Group variables define shared defaults for every VM. Override them in environment
+or host-specific files rather than editing role tasks.
+
+Secrets, private keys, API tokens, and issued certificates must not be committed.
+Use Ansible Vault, SOPS, Vault, or Smallstep-backed workflows when those values
+are introduced.
+

group_vars/all.yml

@@ -0,0 +1,71 @@
+---
+nbops_environment: production
+nbops_admin_user: admin
+nbops_admin_groups:
+  - sudo
+nbops_hostname: "{{ inventory_hostname }}"
+nbops_fqdn: "{{ inventory_hostname }}"
+nbops_timezone: Etc/UTC
+nbops_locale: en_GB.UTF-8
+nbops_ssh_port: 22
+nbops_dns_servers:
+  - 1.1.1.1
+  - 9.9.9.9
+
+nbops_standard_directories:
+  - /srv/docker
+  - /srv/config
+  - /srv/backups
+  - /srv/data
+  - /srv/media
+  - /etc/pki/internal
+  - /etc/pki/internal/private
+  - /etc/pki/internal/certs
+  - /usr/local/share/ca-certificates/internal
+
+nbops_base_packages:
+  - acl
+  - apt-transport-https
+  - bash-completion
+  - ca-certificates
+  - chrony
+  - curl
+  - git
+  - gnupg
+  - htop
+  - jq
+  - locales
+  - lsb-release
+  - needrestart
+  - qemu-guest-agent
+  - rsync
+  - sudo
+  - ufw
+  - unattended-upgrades
+  - vim
+
+nbops_sysctl:
+  net.ipv4.ip_forward: "1"
+  net.ipv6.conf.all.forwarding: "1"
+  fs.inotify.max_user_watches: "1048576"
+  fs.inotify.max_user_instances: "1024"
+
+docker_users:
+  - "{{ nbops_admin_user }}"
+
+ufw_allowed_tcp_ports:
+  - "{{ nbops_ssh_port }}"
+ufw_allowed_udp_ports: []
+
+monitoring_agent: none
+monitoring_packages: []
+
+mtls_ca_certificates: []
+mtls_host_certificates: []
+mtls_private_keys: []
+
+nbops_proxy_network: proxy
+nbops_service_routing_mode: host
+nbops_service_domain_suffix: example.invalid
+nbops_traefik_entrypoint: websecure
+nbops_traefik_tls: true