# offsite environment — non-secret values. Copy to terraform.tfvars and fill in.
#
# Secret is exported as an env var (never in this file); the make tf-* targets do this
# automatically for TF_ENV=offsite, sourcing vault.hetzner.token:
#   export TF_VAR_hcloud_token="...from vault.hetzner.token..."
#
# State is local (see backend.tf).

ansible_ssh_pubkey = "ssh-ed25519 AAAA... ansible@ubongo"
ssh_admin_cidrs    = ["10.20.10.151/32"] # ubongo's LAN address (ADR-021)