167 lines
4.1 KiB
YAML
167 lines
4.1 KiB
YAML
#SPDX-License-Identifier: MIT-0
|
|
---
|
|
# --- Connection ---
|
|
# opnsense_firewall defaults to ansible_host from inventory
|
|
opnsense_firewall: "{{ ansible_host }}"
|
|
opnsense_api_key: "" # set in Ansible Vault
|
|
opnsense_api_secret: "" # set in Ansible Vault
|
|
opnsense_ssl_verify: true
|
|
opnsense_api_port: 443
|
|
|
|
# --- System settings ---
|
|
opnsense_hostname: opnsense
|
|
opnsense_domain: homelan
|
|
opnsense_timezone: Europe/Vienna
|
|
opnsense_dns_servers:
|
|
- 1.1.1.1
|
|
- 8.8.8.8
|
|
|
|
# --- Gateways ---
|
|
# opnsense_gateways:
|
|
# - name: WAN_GW
|
|
# interface: wan
|
|
# gateway: 192.168.1.1
|
|
# ip_protocol: inet
|
|
# default_gw: true
|
|
opnsense_gateways: []
|
|
|
|
# --- VLANs ---
|
|
# opnsense_vlans:
|
|
# - interface: vtnet0
|
|
# tag: 10
|
|
# description: LAN
|
|
opnsense_vlans: []
|
|
|
|
# --- Network topology ---
|
|
# OPNsense interface names as assigned in WebUI (Interfaces → Assignments)
|
|
opnsense_lan_interface: lan
|
|
opnsense_dmz_interface: opt1
|
|
opnsense_guest_interface: opt2
|
|
opnsense_iot_interface: opt3
|
|
|
|
# OPNsense's own IP address — used as DNS target in firewall rules
|
|
# Set this to OPNsense's LAN IP (e.g. 192.168.1.1)
|
|
opnsense_self_address: ""
|
|
|
|
# IoT hosts allowed internet access — list of IPs for iot_internet_allowed alias
|
|
opnsense_iot_internet_allowed: []
|
|
|
|
# --- Firewall aliases ---
|
|
# opnsense_aliases:
|
|
# - name: rfc1918
|
|
# type: network
|
|
# content:
|
|
# - 10.0.0.0/8
|
|
# - 172.16.0.0/12
|
|
# - 192.168.0.0/16
|
|
# description: Private networks
|
|
opnsense_aliases: []
|
|
|
|
# --- Firewall rules ---
|
|
# opnsense_rules:
|
|
# - description: Allow LAN to internet
|
|
# interface: [lan]
|
|
# direction: in
|
|
# action: pass
|
|
# source_net: lan
|
|
# destination_net: any
|
|
# protocol: any
|
|
# enabled: true
|
|
opnsense_rules: []
|
|
|
|
# --- NAT (outbound / masquerade) ---
|
|
# opnsense_nat_source_rules:
|
|
# - description: Masquerade LAN to WAN
|
|
# interface: wan
|
|
# source_net: 192.168.0.0/24
|
|
# target: interface
|
|
# enabled: true
|
|
opnsense_nat_source_rules: []
|
|
|
|
# --- DHCP server ---
|
|
opnsense_dhcp_enabled: false
|
|
opnsense_dhcp_interfaces: []
|
|
opnsense_dhcp_fw_rules: false
|
|
|
|
# opnsense_dhcp_subnets:
|
|
# - subnet: 192.168.1.0/24
|
|
# pools:
|
|
# - 192.168.1.100 - 192.168.1.200
|
|
# gateway: [192.168.1.1]
|
|
# dns: [192.168.1.1]
|
|
# domain: homelan
|
|
# description: LAN
|
|
opnsense_dhcp_subnets: []
|
|
|
|
# opnsense_dhcp_reservations:
|
|
# - ip: 192.168.1.10
|
|
# mac: "aa:bb:cc:dd:ee:ff"
|
|
# hostname: myhost
|
|
# subnet: 192.168.1.0/24
|
|
# description: My host
|
|
opnsense_dhcp_reservations: []
|
|
|
|
# --- Unbound DNS resolver ---
|
|
opnsense_unbound_enabled: true
|
|
opnsense_unbound_port: 53
|
|
opnsense_unbound_dnssec: true
|
|
opnsense_unbound_register_dhcp_leases: false
|
|
opnsense_unbound_register_dhcp_static_mappings: false
|
|
opnsense_unbound_register_system_records: true
|
|
|
|
# Host overrides — aliases are sub-properties of each host entry.
|
|
# alias.domain defaults to the parent host's domain if not set.
|
|
# alias.target is auto-set to hostname.domain of the parent host.
|
|
# opnsense_unbound_hosts:
|
|
# - hostname: vhost0
|
|
# domain: homelan
|
|
# records:
|
|
# - value: 10.61.0.100 # type defaults to A
|
|
# - type: AAAA
|
|
# value: "fd30:882:6101:1::1"
|
|
# aliases:
|
|
# - alias: web
|
|
# - alias: api
|
|
# - hostname: vhost1
|
|
# domain: homelan
|
|
# records:
|
|
# - value: 10.61.0.110
|
|
opnsense_unbound_hosts: []
|
|
|
|
# Selective forwards — leave empty to resolve everything from root servers
|
|
# opnsense_unbound_forwards:
|
|
# - domain: homelan
|
|
# target: 10.61.0.1
|
|
# description: Local domain
|
|
# - domain: internal.example.com
|
|
# target: 192.168.1.53
|
|
# description: Internal DNS
|
|
opnsense_unbound_forwards: []
|
|
|
|
# --- OpenVPN clients ---
|
|
opnsense_openvpn_static_keys: []
|
|
opnsense_openvpn_clients: []
|
|
|
|
# --- WireGuard ---
|
|
opnsense_wireguard_enabled: true
|
|
|
|
# opnsense_wireguard_servers:
|
|
# - name: wg0
|
|
# private_key: "{{ vault_wg_private_key }}"
|
|
# port: 51820
|
|
# allowed_ips:
|
|
# - 10.0.0.1/24
|
|
# peers: []
|
|
# enabled: true
|
|
opnsense_wireguard_servers: []
|
|
|
|
# opnsense_wireguard_peers:
|
|
# - name: client1
|
|
# public_key: "CLIENT_PUBLIC_KEY"
|
|
# allowed_ips:
|
|
# - 10.0.0.2/32
|
|
# servers: [wg0]
|
|
# keepalive: 25
|
|
# enabled: true
|
|
opnsense_wireguard_peers: []
|