---

llng_handler: True
llng_portal: False
llng_manager: False

# Either httpd or nginx
llng_server: httpd

llng_portal_vhost: auth.{{ ansible_domain }}
llng_api_vhost: sso-api.{{ ansible_domain }}
llng_manager_vhost: sso-manager.{{ ansible_domain }}

# If llng_portal and llng_manager are both set to False (only the handler is deployed)
# which conf backend to use. can be api or mysql
llng_conf_backend: api

# List of IP allowed to access SOAP endpoints
# Empty or undefined disable api endpoints
llng_api_src_ip: []

# List of IP allowed to access the manager
llng_manager_src_ip: "{{ trusted_ip }}"

# List of IP allowed to call the reload URI
llng_reload_src_ip: "{{ ansible_all_ipv4_addresses + ['127.0.0.1'] }}"

# When the manager send requests to handlers to reload their config
# should there request use the globally defined proxy.
# This is often not wanted because you want to limit access to the reload
# endpoint only from the manager IP, not from a proxy
llng_reload_use_proxy: False

# If defined, access to api endpoints will require basic auth.
llng_api_user: lemonldapapi
# llng_api_pass: sEcr3t.P@ssw0rd

# SSL for vhosts
# llng_portal_ssl:
#   letsencrypt_cert: auth.{{ ansible_domain }}
#
# Or
#
# llng_portal_ssl:
#   cert: /etc/pki/tls/cert/mycert.crt
#   key: /etc/pki/tls/private/mykey.key
#   cert_chain: /etc/pki/tls/cert/mychain.crt
#
# Same keys exist for api and manager (llng_api_ssl and llng_manager_ssl

# Path to a CA cert if using SSL auth
# llng_portal_ssl.ca: /etc/pki/tls/privateca.crt

# How the manager is protected. Can be none, authenticate, manager, or directly a access rule
llng_manager_protection: manager

# Possibliity to use a MySQL backend
llng_db_server: "{{ mysql_server | default('localhost') }}"
llng_db_name: lemonldapng
llng_db_user: lemonldapng
llng_handler_db_user: lemonldapnghandler
# llng_db_pass: s3cr3t.
# llng_handler_db_pass

# List of headers to protect. Those will be cleared for unauthenticated users
llng_protected_headers:
  - Auth-User
  - User-Name
  - User-Groups
  - User-Mail