2026-06-14 12:03:31 +02:00
|
|
|
# offsite environment — non-secret values. Copy to terraform.tfvars and fill in.
|
|
|
|
|
#
|
|
|
|
|
# Secret is exported as an env var (never in this file); the make tf-* targets do this
|
|
|
|
|
# automatically for TF_ENV=offsite, sourcing vault.hetzner.token:
|
|
|
|
|
# export TF_VAR_hcloud_token="...from vault.hetzner.token..."
|
|
|
|
|
#
|
|
|
|
|
# State is local (see backend.tf).
|
|
|
|
|
|
|
|
|
|
ansible_ssh_pubkey = "ssh-ed25519 AAAA... ansible@ubongo"
|
2026-06-14 12:19:45 +02:00
|
|
|
# The Hetzner Cloud Firewall filters PUBLIC traffic, so this is ubongo's WAN/egress
|
|
|
|
|
# IP (the perimeter analog of OPNsense, ADR-020) — NOT its LAN address. Find it with
|
|
|
|
|
# `curl -s ifconfig.me` from ubongo. Narrows to the NetBird `wt0` path once M5 lands.
|
|
|
|
|
ssh_admin_cidrs = ["203.0.113.10/32"] # placeholder — ubongo's WAN/egress IP
|
