---
# Proxmox-group defaults.
# Per-host overrides go in host_vars/pve1.sweet.home/vars.yml etc.

# proxmox-hardening role toggles
proxmox_harden_ssh: true
proxmox_configure_firewall: true
proxmox_configure_unattended_upgrades: true
proxmox_switch_to_nosub_repo: true
proxmox_disable_nag: true
proxmox_setup_ipa_sudo: true

# Firewall: management CIDR — override per host if subnets differ
# proxmox_mgmt_cidr is set per host in hosts.yml