--- # Domains domain_base: ladkau.de domain_cloud: "cloud.{{ domain_base }}" domain_gitea: "gitea.{{ domain_base }}" domain_nextcloud: "nextcloud.{{ domain_base }}" domain_sso: "sso.{{ domain_base }}" domain_mail: "mail.{{ domain_base }}" domain_registry: "cr.{{ domain_base }}" domain_k8s: "k8s.{{ domain_base }}" domain_vault: "vault.{{ domain_base }}" domain_dl: "dl.{{ domain_base }}" # Let's Encrypt acme_email: matthias.ladkau@gmail.com # Non-root deploy user created by the base role deploy_user: deploy # System timezone timezone: Europe/Berlin # Docker network shared by all services and Traefik traefik_network: traefik_public # Traefik traefik_version: v3.6 traefik_data_dir: /opt/traefik # Dashboard basic-auth users — plaintext passwords, Ansible generates bcrypt hashes at deploy time # traefik_dashboard_users: # - username: admin # password: "your-password" traefik_dashboard_users: [] # Gitea gitea_version: "1" # major-only tag — always pulls latest 1.x patch gitea_db_version: "16" # PostgreSQL major version gitea_data_dir: /opt/gitea # Secrets — store values in ansible/group_vars/all/vault.yml (Ansible Vault) # gitea_db_password: "" # gitea_secret_key: "" # generate: openssl rand -hex 32 # gitea_internal_token: "" # generate: openssl rand -hex 32 # SSO (Keycloak) keycloak_version: "26.2" keycloak_db_version: "16" sso_data_dir: /opt/sso keycloak_admin_user: admin # Secrets — store values in ansible/group_vars/all/vault.yml (Ansible Vault) # keycloak_db_password: "" # keycloak_admin_password: "" # Nextcloud nextcloud_version: "31-apache" # apache variant includes a working web server nextcloud_db_version: "16" nextcloud_data_dir: /opt/nextcloud nextcloud_admin_user: admin # Secrets — store values in ansible/group_vars/all/vault.yml (Ansible Vault) # nextcloud_db_password: "" # nextcloud_admin_password: "" # Mail (Roundcube + Dovecot IMAP + Fetchmail) roundcube_version: "1.6.x-apache" roundcube_db_version: "16" mail_data_dir: /opt/mail # Dovecot IMAP server — Roundcube always connects to the local Dovecot container dovecot_version: "2.3" # SMTP — outgoing mail server for Roundcube (leave empty if not configured) roundcube_smtp_host: "" roundcube_smtp_port: "587" # Fetchmail — polls external POP3 accounts and delivers to local Dovecot via LMTP # poll_minutes is per-account (default: 10 minutes) # Secrets — store values in ansible/group_vars/all/vault.yml (Ansible Vault) # roundcube_db_password: "" # roundcube_des_key: "" # generate: openssl rand -hex 12 (must be exactly 24 chars) # # Dovecot users — list of {username, password} pairs (plaintext, vault is encrypted) # dovecot_users: # - username: alice # password: "plaintext-password" # # Fetchmail accounts — list of external POP3 sources to poll # fetchmail_accounts: # - server: pop.gmail.com # username: user@gmail.com # password: app-password # local_user: alice # protocol: pop3 # default: pop3 # ssl: true # default: true # keep: true # default: true — set false to delete from source after fetch # Gitea Actions runners (act_runner with Docker executor) act_runner_version: "latest" act_runner_data_dir: /opt/act_runner act_runner_count: 3 # Secrets — store values in ansible/group_vars/all/vault.yml (Ansible Vault) # gitea_runner_registration_token: "" # Gitea admin → Site Administration → Runners → Create runner token # Container registry (Docker Registry v2 + web UI) registry_data_dir: /opt/registry registry_ui_version: "main" # Registry users — plaintext passwords, Ansible generates bcrypt hashes at deploy time # registry_users: # - username: alice # password: "your-password" # k8s (placeholder) k8s_data_dir: /opt/k8s # Vaultwarden (self-hosted Bitwarden-compatible password vault) vaultwarden_version: "1.37.1" vaultwarden_data_dir: /opt/vaultwarden # Secrets — store values in ansible/group_vars/all/vault.yml (Ansible Vault) # vaultwarden_admin_token: "" # generate: openssl rand -hex 32 # vaultwarden_sso_client_secret: "" # added after Keycloak is configured — see runbook-configuration.md step 2.6 # Download server (nginx HTTPS + SFTP) dl_data_dir: /opt/dl dl_upload_user: uploader dl_sftp_port: 2223 # Secrets — store values in ansible/group_vars/all/vault.yml (Ansible Vault) # dl_sftp_authorized_keys: | # ssh-ed25519 AAAA... gitea-actions # Status dashboard (public — cloud.ladkau.de root) dashboard_data_dir: /opt/dashboard # Ollama — local LLM server, internal network only (no public route) ollama_version: "0.35.1" ollama_data_dir: /opt/ollama ollama_model: "qwen3:4b-instruct-2507-q4_K_M" # non-thinking variant: the thinking model needs minutes per answer on this CPU ollama_context_length: 16384 ollama_mem_limit: 4608m ollama_keep_alive: "1h" # unload the model after this idle time to free RAM # Browserless — headless Chromium for rendering JavaScript-heavy pages (internal only) browserless_version: "v2.57.0" browserless_data_dir: /opt/browserless browserless_mem_limit: 1g # SearXNG — metasearch backend for the n8n web_search tool (internal only) searxng_version: "2026.10.2-19ffbcd30" searxng_data_dir: /opt/searxng searxng_mem_limit: 384m # Secrets — store values in ansible/group_vars/all/vault.yml (Ansible Vault) # searxng_secret_key: "" # generate: openssl rand -hex 32 # n8n — workflow automation, AI chat and scheduled digests (agent.ladkau.de) domain_n8n: "agent.{{ domain_base }}" n8n_version: "2.41.6" n8n_data_dir: /opt/n8n n8n_timezone: "Europe/Berlin" n8n_mem_limit: 768m # Fixed webhook id of the chat workflow: the chat page is served at # https://agent./webhook//chat and https://agent./chat redirects there. # Must match "webhookId" in roles/n8n/files/workflows/chat.json. n8n_chat_webhook_id: "3f2b6c1e-8a4d-4e57-9b0a-6d1c2e7f5a10" # Fixed webhook id of the Telegram trigger; must match "webhookId" in roles/n8n/files/workflows/telegram-chat.json. n8n_telegram_webhook_id: "7c1d4e92-5b3a-4f08-a6e1-2d9b8c0f3a47" # Source addresses allowed to call the Telegram webhook (Telegram's webhook servers, see # core.telegram.org/bots/webhooks). Set to [] to disable the address filter. telegram_webhook_source_ranges: - 149.154.160.0/20 - 91.108.4.0/22 n8n_users: [] # override in vault with [{username: ..., password: ...}] — basic auth in front of n8n # Outgoing mail for n8n (Strato SMTP) smtp_host: "smtp.strato.de" smtp_port: 465 smtp_secure: true # true = implicit TLS (port 465); false = STARTTLS (port 587) # Secrets — store values in ansible/group_vars/all/vault.yml (Ansible Vault) # n8n_encryption_key: "" # generate: openssl rand -hex 32 # gemini_api_key: "" # Google AI Studio API key (default model of the Telegram chat) # telegram_bot_token: "" # from @BotFather # telegram_user_id: "" # your numeric Telegram user id (the only user the bot answers) # smtp_user: "" # full Strato mailbox address # smtp_password: "" # n8n_users: # - username: admin # password: "your-password"