v2

defaults/main.yml

@@ -1,2 +1,73 @@
----
-# defaults file for ansible-role-wikideck
+# SPDX-License-Identifier: MIT-0
+---
+# Required: publish an image built from Wikideck's production Dockerfile.
+wikideck_image: ""
+wikideck_name: wikideck
+wikideck_namespace: wikideck
+wikideck_create_namespace: true
+
+# null uses normal kubeconfig discovery, including KUBECONFIG.
+wikideck_kubeconfig: null
+wikideck_kube_context: null
+wikideck_wait: true
+wikideck_wait_timeout: 300
+wikideck_image_pull_policy: IfNotPresent
+# Existing registry Secret names in the application namespace.
+wikideck_image_pull_secrets: []
+
+wikideck_offline: false
+# Exact browser origin, without a trailing slash. Required when using ingress.
+wikideck_public_origin: ""
+wikideck_ingress_enabled: false
+wikideck_ingress_host: ""
+wikideck_ingress_class_name: ""
+wikideck_ingress_annotations: {}
+# Existing TLS Secret, or one provisioned by cert-manager via annotations.
+wikideck_tls_secret_name: "{{ wikideck_name }}-tls"
+
+# Persistence is mandatory; existing claims are never modified by this role.
+wikideck_existing_claim: ""
+wikideck_storage_size: 1Gi
+# null: cluster default; "": no StorageClass; otherwise: named class.
+wikideck_storage_class: null
+wikideck_storage_access_modes:
+  - ReadWriteOnce
+
+wikideck_resources:
+  requests:
+    cpu: 100m
+    memory: 128Mi
+  limits:
+    cpu: "1"
+    memory: 512Mi
+wikideck_node_selector: {}
+wikideck_tolerations: []
+wikideck_affinity: {}
+
+# Requires a NetworkPolicy-capable CNI. Same-namespace clients only by default.
+wikideck_network_policy_enabled: true
+# Kubernetes NetworkPolicyPeer objects; controller namespaces must be explicit.
+wikideck_network_policy_ingress_from:
+  - podSelector: {}
+# DNS is allowed to kube-system on UDP/TCP 53. Adapt for NodeLocal/custom DNS.
+wikideck_network_policy_dns_to:
+  - namespaceSelector:
+      matchLabels:
+        kubernetes.io/metadata.name: kube-system
+# Live article discovery needs HTTPS. Standard NetworkPolicy cannot select FQDNs.
+wikideck_network_policy_https_to:
+  - ipBlock:
+      cidr: 0.0.0.0/0
+      except:
+        - 10.0.0.0/8
+        - 100.64.0.0/10
+        - 127.0.0.0/8
+        - 169.254.0.0/16
+        - 172.16.0.0/12
+        - 192.168.0.0/16
+  - ipBlock:
+      cidr: "::/0"
+      except:
+        - "::1/128"
+        - "fc00::/7"
+        - "fe80::/10"