ebd21623ef
host_vars: DATA VLAN 30 (ether1 uplink + ether2-7 + sfp1/2), isolated MGMT VLAN 99 on ether8, mgmt 192.168.88.1/24, no gateway, NTP disabled. Role: switch_ntp_enabled flag (enable/disable NTP), conditional default route (skip when no gateway), and a guarded removal of the legacy defconf bridge IP so the mgmt IP lives only on vlan-mgmt. Membership Jinja re-validated; lint+syntax clean. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
39 lines
1.3 KiB
YAML
39 lines
1.3 KiB
YAML
---
|
|
# ----- Identity / management -----
|
|
switch_identity_name: "{{ inventory_hostname }}"
|
|
switch_mgmt_vlan_id: 99
|
|
switch_mgmt_address: "192.168.88.1/24" # PLACEHOLDER — override in host_vars
|
|
switch_mgmt_gateway: "192.168.88.254" # PLACEHOLDER — override in host_vars
|
|
switch_dns_servers: "192.168.88.254"
|
|
switch_ntp_enabled: true # set false for an isolated mgmt plane
|
|
switch_ntp_servers: "192.168.88.254"
|
|
|
|
# Services to disable for hardening (winbox kept on by default for recovery)
|
|
switch_disabled_services:
|
|
- telnet
|
|
- ftp
|
|
- www
|
|
- www-ssl
|
|
- api
|
|
- api-ssl
|
|
switch_ssh_port: 22
|
|
|
|
# ----- Users -----
|
|
switch_admin_user: "sjat"
|
|
switch_admin_group: "full"
|
|
switch_admin_ssh_pubkey_file: "~/.ssh/id_ed25519.pub"
|
|
switch_disable_default_admin: true
|
|
|
|
# ----- VLAN / bridge / ports (PLACEHOLDER example) -----
|
|
# Real topology is defined in host_vars/<switch>.yml.
|
|
switch_bridge_name: "bridge"
|
|
switch_vlans:
|
|
- {id: 99, name: "mgmt"}
|
|
- {id: 10, name: "members"}
|
|
switch_bridge_ports:
|
|
# ether1..ether8 = 2.5GbE access ports; sfp-sfpplus1/2 = 10G uplinks
|
|
- {interface: "ether1", pvid: 10, mode: access}
|
|
- {interface: "sfp-sfpplus1", pvid: 1, mode: trunk, tagged_vlans: [99, 10]}
|
|
|
|
# ----- Firmware -----
|
|
switch_firmware_target: "" # set in host_vars when opting into upgrades
|