---
# proxmox-hardening role defaults.
# Override in inventory/group_vars/proxmox.yml or host_vars/<host>/vars.yml.

proxmox_harden_ssh: true
proxmox_configure_firewall: true
proxmox_configure_unattended_upgrades: true
proxmox_switch_to_nosub_repo: true
proxmox_disable_nag: true
proxmox_setup_ipa_sudo: true

# Management CIDR for the PVE datacenter firewall (inbound allow-list).
# Must be set per-host in inventory (hosts.yml) — no default here to force explicit assignment.
# proxmox_mgmt_cidr: "192.168.2.0/24"

# Named PVE admin username to create (set to "" to skip user creation).
# proxmox_admin_username: "wayne"

# fail2ban sshd jail settings
proxmox_fail2ban_maxretry: 5
proxmox_fail2ban_bantime: "1h"
proxmox_fail2ban_findtime: "10m"