# SPDX-License-Identifier: MIT
---
# The provider for nbde_server role. Currently 'tang' is supported.
nbde_server_provider: tang

# nbde_server_service_state indicates the state the nbde_server should be.
# It can be either started (default) or stopped. started means the server
# is accepting connections, whereas stopped means it is not accepting
# connections.
nbde_server_service_state: started

# nbde_server_rotate_keys indicates whether we should rotate existing keys
# -- if any -- , then create new keys. Default behavior (no) is to create
# new keys, if there are none, and don't touch the keys, if they exist.
# If set to yes, existing keys will be rotated and new keys will be created.
nbde_server_rotate_keys: false

# nbde_server_fetch_keys indicates whether we should fetch keys to the
# control node, in which case they will be placed in nbde_server_keys_dir.
# You must set nbde_server_keys_dir to use `nbde_server_fetch_keys.
nbde_server_fetch_keys: false

# nbde_server_deploy_keys indicates whether we should deploy the keys
# located in nbde_server_keys_dir directory to the remote hosts. You must
# set nbde_server_keys_dir to use nbde_server_deploy_keys.
nbde_server_deploy_keys: false

# nbde_server_keys_dir specifies a directory in the control node that
# contains keys to be deployed to the remote hosts. Keys located in the
# top level directory will be deployed to every remote host, while keys
# located within subdirectories named after the remote hosts  -- as per
# the inventory -- will be deployed only to these specific hosts.
# nbde_server_keys_dir must be an absolute path. You need to set this
# to use either nbde_server_fetch_keys and/or nbde_server_deploy_keys.
nbde_server_keys_dir: ""

# nbde_server_port indicate the port that nbde_server's firewall should open.
# The default port is 80. Tang uses the TCP protocol. Thus the specified port
# will listen on the nbde_server_port/TCP
nbde_server_port: 80

# nbde_server_firewall_zone indicate the zone that nbde_server's firewall
# should write into. The default zone is public. If that is not the case you
# can change that here. Usually it should be left like that.
nbde_server_firewall_zone: public

# If true, manage the nbde server port using the firewall role.
nbde_server_manage_firewall: false

# If true, manage the nbde server port using the selinux role.
nbde_server_manage_selinux: false

# vim:set ts=2 sw=2 et:
