# DO NOT MODIFY THIS FILE!  CHANGES WILL BE LOST WHEN "git pull" IS RUN!
# PUT YOUR CUSTOMIZATIONS HERE: /etc/iiab/local_vars.yml
# READ "What is local_vars.yml and how do I customize it?" IN http://FAQ.IIAB.IO

# By convention we use True/False to indicate boolean values.

# Configuration Files
iiab_local_vars_file: /etc/iiab/local_vars.yml
iiab_env_file: /etc/iiab/iiab.env
iiab_ini_file: /etc/iiab/iiab.ini

iiab_base: /opt/iiab
iiab_dir: "{{ iiab_base }}/iiab"
pip_packages_dir: "{{ iiab_base }}/pip-packages"
yum_packages_dir: "{{ iiab_base }}/yum-packages"
downloads_dir: "{{ iiab_base }}/downloads"
iiab_download_url: http://download.iiab.io/packages
iiab_osm_url : http://download.iiab.io/content/OSM/vector-tiles

content_base: "/library"
doc_base: "{{ content_base }}/www"
doc_root: "{{ doc_base }}/html"

# Ansible's default timeout for "get_url:" downloads (10 seconds) often fails
download_timeout: 200

# Languages (for Apache)
default_language: en
language_priority: en es fr

# Set iiab_admin_user_install: False if you don't want iiab_admin_user & wheel
# group auto-created in roles/iiab-admin/tasks/main.yml (hence disabling sudo-
# checks/warnings of published passwds like pi/raspberry & iiab-admin/g0adm1n).
iiab_admin_user_install: True
# If iiab_admin_user_install: False, set iiab_admin_user (below) to an existing
# Linux user that has sudo access, for login to Admin Console http://box/admin
# ODDLY THIS IS ALSO USED BY roles/usb-lib/tasks/main.yml TO SET GROUP PERM FOR /library/www/html/local_content (ISN'T {{ apache_user }} MORE APPROPRIATE?)
iiab_admin_user: iiab-admin
iiab_admin_published_pwd: g0adm1n    # For live checks/alerts of published pwds
# Password hash to override above, if Ansible creates above user:
iiab_admin_pwd_hash: $6$xsce51$D.IrrEeLBYIuJkGDmi27pZUGOwPFp98qpl3hxMwWV4hXigFGmdSvy3s/j7tn6OnyTTLmlV7SsN0lCUAFzxSop.
# Obtain a password hash - NEW MORE SECURE WAY:
#    python3 -c 'import crypt; print(crypt.crypt("<plaintext>", crypt.mksalt(crypt.METHOD_SHA512)))'
# Obtain a password hash - OLD WAY:
#    python -c 'import crypt; print crypt.crypt("<plaintext>", "$6$<salt>")'

# Time Zone (php needs timezone to be set)
local_tz: "{{ ansible_date_time.tz }}"

# Read https://github.com/iiab/iiab/wiki/IIAB-Networking
# Also readable offline @ http://box/info/IIAB-Networking.html

# NETWORK PARAMETERS FOLLOW ACROSS THE NEXT 100 LINES, as enabled by Ansible's
# NETWORK role (/opt/iiab/iiab/roles/network/*) in 4-SERVER-OPTIONS below.
# SEE ALSO: /opt/iiab/iiab/roles/network/defaults/main.yml

# The following variable may be useful in debugging
disregard_network: False  # use cache or error out if cache does not exist

iiab_hostname: box
iiab_domain: lan
lan_ip: 172.18.96.1
lan_netmask: 255.255.224.0

# Homepage: set to /home or /wordpress or /mediawiki or /wiki (for DokuWiki)
iiab_home_url: /home

# Internal Wi-Fi Access Point
# Values are used if there is an internal Wi-Fi adapter and hostapd is enabled
# The platform variable adapts install to specific hardware (raspberry pi=rpi2)
# Raspbian req WiFi country since March 2018.  CHANGE IT IN /etc/iiab/local_vars.yml
host_country_code: US
host_ssid: "Internet in a Box"
host_wifi_mode: g
host_channel: 6
hostapd_secure: False
hostapd_password: changeme
hostapd_enabled: True
# Above is forcibly set to False (in roles/network/tasks/main.yml) if IIAB is
# being WiFi-installed (run "iiab-hotspot-on" AFTER ./iiab-install completes
# and content is downloaded, to enable the internal WiFi Access Point / AP!)
reboot_to_AP: False
# For those installing IIAB over WiFi: "reboot_to_AP: True" overrides the above
# detection of WiFi-as-gateway, forcing "hostapd_enabled: True" regardless.

# Gateway mode
iiab_lan_enabled: True
iiab_wan_enabled: True
ssh_port: 22
# Ties in what the user populated in the GUI for static WAN IP address info:
gui_wan: True
adm_cons_force_ssl: False
adm_cons_allow_downloads: False

# Enables "campus access" to kiwix (3000), kalite (8008) & calibre (8010 or
# 8080) on WAN side of server. See network/templates/gateway/iiab-gen-iptables
# within github.com/iiab/iiab/blob/master/roles/
services_externally_visible: True

# Gateway and Filters
# Most all implementations use "iiab_gateway_enabled: False" within
# local_vars.yml as they cannot afford Internet access for students
# and teachers, and the many associated IT/support/training costs.
iiab_gateway_enabled: False
gw_squid_whitelist: False
gw_block_https: False

dhcpd_install: False
dhcpd_enabled: False

# named (BIND)
named_install: False
named_enabled: False
block_DNS: False

# dnsmasq - handles DHCP and DNS
dnsmasq_install: True
dnsmasq_enabled: True

# Enable in local_vars.yml AFTER installing IIAB!  Then run "cd /opt/iiab/iiab; ./iiab-network"
dns_jail_enabled: False

# Python-based Captive Portal, that @m-anish & @jvonau experimented with in
# July 2018 (https://github.com/iiab/iiab/pull/870) and that @georgejhunt
# extensively refined later in 2018 (PRs #1179, #1300, #1327).
captive_portal_install: False
captive_portal_enabled: False
captive_portal_port: 9090
# In a pinch, disable Captive Portal using instructions in http://FAQ.IIAB.IO

# Set to "False" if you want to revert to the older Dynamic Menuing system
# (prior to IIAB 6.7, this had used https://github.com/iiab/iiab-menu)
js_menu_install: True

# Unmaintained as of October 2017: https://github.com/iiab/iiab/pull/382
wondershaper_install: False
wondershaper_enabled: False

# Intended for developers: ONLY CHANGE THESE IF YOU KNOW WHAT YOU ARE DOING
# The following 2 override the detection when not "auto"
user_wan_iface: auto
user_lan_iface: auto
wan_ip: dhcp
wan_netmask:
wan_gateway:
wan_nameserver:


# Parameters for Aggregate Roles
# Each Role should have the following variables which are either True or False:
#   <role-name>_install
#   <role-name>_enabled

# Past convention had been to install everything in all aggregate roles (stages)
# And to enable everything in 1-PREP, 2-COMMON, and 3-BASE-SERVER


# 1-PREP

sshd_enabled: True

# roles/iiab-admin runs here
# SEE IIAB-ADMIN VARIABLES NEAR TOP OF THIS FILE: e.g. iiab_admin_user_install,
# iiab_admin_user, iiab_admin_published_pwd, iiab_admin_pwd_hash

openvpn_install: True
openvpn_enabled: False
# For /etc/iiab/openvpn_handle
openvpn_handle: ""
# cron seems necessary on CentOS:
openvpn_cron_enabled: False
# General OpenVPN settings
openvpn_server: xscenet.net
openvpn_server_virtual_ip: 10.8.0.1
openvpn_server_port: 1194


# 2-COMMON

# Auto-enabled in roles/2-common/tasks/packages.yml as set in
# 0-init/defaults/main.yml AND 0-init/tasks/main.yml :
exFAT_enabled: True

# /usr/libexec/iiab-startup.sh is much like autoexec.bat & /etc/rc.local
# It's put in place by 2-common/tasks/iiab-startup.yml at the end of Stage 2.


# 3-BASE-SERVER

# Make this False to disable http://box/common/services/power_off.php button:
apache_allow_sudo: True
# For schools that use WordPress and/or Moodle intensively, see iiab/iiab #1147
# WARNING: Enabling this might cause excess use of RAM/disk or other resources!
apache_high_php_limits: False
# SEE ALSO VARIABLES NEAR TOP OF THIS FILE: default_language, language_priority

# MySQL MANDATORY - THESE SETTINGS HAVE NO EFFECT - SEE roles/1-prep/tasks/computed_vars.yml, roles/mysql/tasks/main.yml
mysql_install: True
mysql_enabled: True
# mysql_root_password: $6$iiab51$3ICIW0CLWxxMW2a3yrHZ38ukZItD5tcadL4rWcE9D.qIGStxhh8rRsaSxoj3b.MYxI/VRDNjpzSYK/V6zkWFI0
mysql_root_password: fixmysql


# 4-SERVER-OPTIONS

# DNS prep (dnsmasq, named &/or dhcpd) run here.  The full network stage runs
# after 9-LOCAL-ADDONS (or manually run "cd /opt/iiab/iiab; ./iiab-network")

squid_install: False
squid_enabled: False

# DansGuardian REQUIRES Squid (above) be installed & enabled
dansguardian_install: False
dansguardian_enabled: False

# PostgreSQL auto-installed by Moodle &/or Pathagar as nec, no need to touch!
# roles/1-prep/tasks/computed_vars.yml, roles/4-server-options/tasks/main.yml
postgresql_install: False
postgresql_enabled: False

# Unmaintained
# authserver_install: False
# authserver_enabled: False

# Common UNIX Printing System (CUPS)
cups_install: False
cups_enabled: False
cups_port: 631

# Samba.  Do a security audit seriously before deploying this.
samba_install: False
samba_enabled: False
shared_dir : "{{ content_base }}/public"    # /library/public

# usb-lib
usb_lib_install: True
usb_lib_enabled: True
# Show entire contents of USB sticks/drives (at http://box/usb)
iiab_usb_lib_show_all: True

# Toggle iiab-refresh-wiki-docs scraping for offline docs (http://box/info)
nodocs: False


# 5-XO-SERVICES

# Lesser-supported XO services need additional testing.  Please contact
# http://lists.laptop.org/pipermail/server-devel/ if you're able to help test.

xo_services_install: False
xo_services_enabled: False

activity_server_install: False
activity_server_enabled: False

# Please instead consider 'ejabberd' in Stage 6-GENERIC-APPS below
ejabberd_xs_install: False
ejabberd_xs_enabled: False

# Change calibre_port from 8080 to 8010 below, if you enable idmgr
idmgr_install: False
idmgr_enables: False


# 6-GENERIC-APPS

dokuwiki_install: False
dokuwiki_enabled: False

mediawiki_install: False
mediawiki_enabled: False

ejabberd_install: False
ejabberd_enabled: False

elgg_install: False
elgg_enabled: False
# elgg_mysql_password: $6$iiab51$jeTwnATcbaa92xo0QBTgjLBU.5aVDDrbKeNyyC99R/TAWz6pvfzj.L7lfnOVVjD78nxqT.gkNn6XZmuRV0W3o1
elgg_mysql_password: elgg4kids

# Gitea (lightweight self-hosted "GitHub") from https://gitea.io
gitea_install: False
gitea_enabled: False

# Lokole (email for rural communities) from https://ascoderu.ca
lokole_install: False
lokole_enabled: False

# MQTT pub-sub broker for IoT on Raspberry Pi etc
mosquitto_install: False
mosquitto_enabled: False
mosquitto_port: 1883

# Node.js version used by roles/nodejs/tasks/main.yml for 3 roles:
# nodered (Node-RED), pbx (Asterix, FreePBX) & sugarizer (Sugarizer)
nodejs_version: 10.x    # was 8.x until 2019-02-02

# Flow-based visual programming for wiring together IoT hardware devices etc
nodered_install: False
nodered_enabled: False
nodered_port: 1880
nodered_web_path: nodered

nextcloud_install: False
nextcloud_enabled: False

# A full-featured PBX (for rural telephony, etc) based on Asterisk and FreePBX.
# Works on Ubuntu 18.04, Debian 9. Experimental on Rasp/RPi 3. Uses Node.js 10.x
pbx_install: False
pbx_enabled: False
asterisk_chan_dongle: False
pbx_signaling_ports_chan_sip: "5160:5161"
pbx_signaling_ports_chan_pjsip: "5060"
pbx_data_ports: "10000:20000"

# If using WordPress intensively, set apache_high_php_limits in 3-BASE-SERVER
wordpress_install: False
wordpress_enabled: False


# 7-EDU-APPS

# KA Lite - SEE THE "Transmission" BITTORRENT DOWNLOADER FURTHER BELOW, TO INSTALL THOUSANDS OF VIDEOS
kalite_install: True
kalite_enabled: True
kalite_server_port: 8008
kalite_root: "{{ content_base }}/ka-lite"    # /library/ka-lite
# Unused in 2018; but remain as placeholders for Fedora 18 legacy (XO laptops)
kalite_cron_enabled: False
kalite_user: kalite
kalite_password_hash: $6$<salt>$KHET0XRRsgAY.wOWyTOI3W7dyDh0ESOr48uI5vtk2xdzsU7aw0TF4ZkNuM34RmHBGMJ1fTCmOyVobo0LOhBlJ/
kalite_password: kalite

kolibri_install: False
kolibri_enabled: False
kolibri_http_port: 8009

kiwix_install: True
kiwix_enabled: True
kiwix_port: 3000
iiab_zim_path: "{{ content_base }}/zims"    # /library/zims

moodle_install: False
moodle_enabled: False
# If using Moodle intensively, set apache_high_php_limits in 3-BASE-SERVER

# MongoDB (/library/dbdata/mongodb) is used by Sugarizer:
# Its 2 settings below are auto-set to True (in roles/0-init/tasks/main.yml) when: sugarizer_enabled
# The mongodb playbook itself is later invoked by roles/sugarizer/meta/main.yml
mongodb_install: False
mongodb_enabled: False
mongodb_port: 27018

# Regional OSM vector maps take much less disk space than image versions
osm_vector_install: True
osm_vector_enabled: True
osm_vector_path: '{{ content_base }}/osm-vector'

# roles/sugarizer/meta/main.yml auto-invokes 2 above prereqs: mongodb & nodejs
# Might stall MongoDB on Power Failure: github.com/xsce/xsce/issues/879
# Sugarizer 1.0.1+ strategies to solve? github.com/iiab/iiab/pull/957
sugarizer_install: False
sugarizer_enabled: False
sugarizer_port: 8089


# 8-MGMT-TOOLS

# Transmission is a BitTorrent downloader for large Content Packs etc
transmission_install: False
transmission_enabled: False

# Transmission download directory & general owner/group
transmission_download_dir: "{{ content_base }}/transmission/"    # /library/transmission/
transmission_user: debian-transmission
transmission_group: root

# Monitor downloads at http://box:9091 or http://box:9091/transmission using Admin/changeme
transmission_http_port: 9091
transmission_url : "/transmission/"
transmission_peer_port: 51413

# Provision Transmission with torrent(s) from http://pantry.learningequality.org/downloads/ka-lite/0.17/content/
transmission_provision: True
transmission_kalite_version: 0.17

# A. UNCOMMENT LANGUAGE(S) IN /etc/iiab/local_vars.yml TO DOWNLOAD KA Lite VIDEOS TO /library/transmission
transmission_kalite_languages:
  #- english
  #- french
  #- hindi
  #- portugal-portuguese
  #- brazilian-portuguese
  #- spanish
  #- swahili
# B. Monitor BitTorrent downloads at http://box:9091 using Admin/changeme
#    until the download is confirmed complete (can take hours if not days!)
# C. Carefully move all videos/thumbnails into /library/ka-lite/content
#    (DO NOT OVERWRITE SUBFOLDERS assessment, locale, srt !)
# D. Log in to KA Lite at http://box:8008/updates/videos/ using Admin/changeme
#    then click "Scan content folder for videos" (can take many minutes!)
# E. READ "KA Lite Administration: What tips & tricks exist?" AT http://FAQ.IIAB.IO

# Transmission administrative account
transmission_username: Admin
transmission_password: changeme

awstats_install: True
awstats_enabled: True

monit_install: False
monit_enabled: False
watchdog:
  - sshd
  - idmgr
  - ejabberd
  - httpd
  - postgresql
  - squid

munin_install: True
munin_enabled: True

# Handy for maintaining tables, but DANGEROUS if not locked down
phpmyadmin_install: False
phpmyadmin_enabled: False

vnstat_install: True
vnstat_enabled: True


# 9-LOCAL-ADDONS

# Calibre E-Book Library
# WARNING: CALIBRE INSTALLS GRAPHICAL LIBRARIES SIMILAR TO X WINDOWS & OPENGL
# ON (HEADLESS, SERVER, LITE) OS'S THAT DON'T ALREADY HAVE THESE INSTALLED.
calibre_install: False
calibre_enabled: False
# vars/raspbian-9.yml tries the .deb upgrade of Calibre, overriding this default:
calibre_via_debs: False
calibre_unstable_debs: False
# vars/<most-OS's>.yml use Calibre's python installer/upgrader (x86_64), overriding this default:
calibre_via_python: False
# Change calibre_port to 8010 if you're using XO laptops needing above idmgr ?
calibre_port: 8080
# http://box:8080 & http://box:8080/mobile WORK FOR NOW, but short/mnemonic
# URL's like http://box/calibre DON'T YET WORK -- BOOKS RARELY DISPLAY:
calibre_web_path: calibre    # NEEDS WORK: https://github.com/iiab/iiab/issues/529
# Avoid URL collisions with calibreweb_url: below!

# WARNING: Calibre-Web (below) depends on Calibre's own /usr/bin/ebook-convert
# program, so we recommend you also install Calibre (above!)

# Calibre-Web alternative to Calibre, offers a clean/modern UX
calibreweb_install: False
calibreweb_enabled: False
calibreweb_port: 8083    # PORT VARIABLE HAS NO EFFECT (as of January 2019)
# http://box/books works.  Add {box/libros, box/livres, box/livros, box/liv} etc?
calibreweb_url: /books
calibreweb_home: "{{ content_base }}/calibre-web"    # /library/calibre-web

# Minetest is an open source clone of the Minecraft building blocks game
minetest_install: False
minetest_enabled: False
minetest_port: 30000
minetest_server_admin: Admin
minetest_default_game: carbone-ng    # only carbone-ng and minetest are supported
minetest_flat_world: False


# CONSIDER THESE 2 NEW OPENSTREETMAP (OSM) APPROACHES INSTEAD, AS OF 2018:
# - http://download.iiab.io/content/OSM/vector-tiles/
# - http://oer2go.org/viewmod/en-worldmap-10
#
# DOWNLOAD EITHER OSM MANUALLY, OR BETTER YET TRY IIAB'S ADMIN CONSOLE:
#   http://box/admin -> Install Content -> Get OER2GO(RACHEL) Modules
#
# Unmaintained:
# osm_install: False
# osm_enabled: False
# Changed in June 2017, from the original:
# iiab_install: True
# iiab_enabled: False

# Unmaintained (better to install from http://teamviewer.com or prep scripts at http://download.iiab.io)
# teamviewer_install: False
# teamviewer_enabled: False

# Unmaintained
# docker_install: False
# docker_enabled: False

# Unmaintained
# schooltool_install: False
# schooltool_enabled: False

# Unmaintained
# debian_schooltool_install: False
# debian_schooltool_enabled: False

# Unmaintained (consider Calibre or Calibre-Web above?)
# pathagar_install: False
# pathagar_enabled: False

# Unmaintained
# sugar_stats_install: False
# sugar_stats_enabled: False

# Unmaintained
# xovis_install: False
# xovis_enabled: False
# xovis_target_host: "127.0.0.1:5984"
# xovis_deployment_name: olpc
# xovis_db_name: xovis
# xovis_db_user: admin
# xovis_db_password: admin
# xovis_root: "/opt/xovis"
# xovis_backup_dir: "/library/users"
# xovis_chart_heading: "My School: Usage Data Visualization"

# Unmaintained
# owncloud_install: False
# owncloud_enabled: False

# Unmaintained
# ajenti_install: False
# ajenti_enabled: False

# Unmaintained
# rachel_install: False
# rachel_enabled: False
# rachel_content_found: False
# #rachel_url: /rachel
# rachel_doc_root: "{{ doc_root }}/modules"

# ================================================================

# Platforms - turn all off and let /opt/iiab/iiab/vars/<OS>.yml turn on as appropriate

# Wide to narrow (insofar as poss)
is_debuntu: False    # covers all 3: Ubuntu, Debian, Raspbian

is_ubuntu: False
is_ubuntu_19: False
is_ubuntu_18: False
is_ubuntu_17: False
is_ubuntu_16: False

is_debian: False    # covers both: Debian, Raspbian
is_debian_10: False
is_debian_9: False
is_debian_8: False

is_raspbian: False    # covers RPi HW and non-RPi HW versions of Raspbian
is_raspbian_10: False
is_raspbian_9: False
is_raspbian_8: False
is_rpi: False    # 2019-03-23 - doesn't yet test for RPi HW, but hopefully soon: https://github.com/iiab/iiab/issues/1406

is_redhat: False    # not well supported as of 2019, see: https://github.com/iiab/iiab/issues/1434
is_centos: False
is_centos_7: False
is_fedora: False
is_fedora_22: False
is_fedora_18: False

# How This Works:
# 1. /opt/iiab/iiab/iiab-install copies scripts/local_facts.fact to /etc/ansible/facts.d/local_facts.fact
# 2. Ansible runs /etc/ansible/facts.d/local_facts.fact to identify the OS
# 3. ./iiab-install (iiab-stages.yml) or ./runrole (run-one-role.yml) or Admin Console (iiab-from-console.yml) invoke the correct /opt/iiab/iiab/vars/<OS>.yml
# Longer Explanation: https://github.com/iiab/iiab/wiki/IIAB-Variables (Order of Execution and Precedence)