---
# freeipa role defaults — all overridable in inventory host_vars or group_vars.
# Most values come from the per-host inventory (see hosts.yml).

ipa_realm: "SWEET.HOME"
ipa_domain: "sweet.home"

# Set these per-host in inventory/hosts.yml:
# ipa_hostname: "domain-controller.sweet.home"
# ipa_ip: "192.168.2.253"
# ipa_dns_forwarder: "<router_gateway_ip>"  # upstream resolver for non-sweet.home queries
#
# Note: the conditional forwarder for *.ts.net → tailscale-router (192.168.2.222)
# is configured post-install via `ipa dnsforwardzone-add tail13f623.ts.net --forwarder=192.168.2.222`.
# This is what allows LAN clients to resolve Tailscale hostnames through FreeIPA.
# The NixOS tailscale-router build type configures the other direction automatically.

# Swap file created if no swap exists (FreeIPA needs headroom during install)
ipa_swap_size_mb: 2048