initial commit

vault/secrets.yml.example

@@ -0,0 +1,27 @@
+---
+# Template for sensitive variables.
+#
+# Usage:
+#   1. cp secrets.yml.example secrets.yml
+#   2. Fill in the values below
+#   3. ansible-vault encrypt vault/secrets.yml
+#   4. Store the vault password in .vault_pass (chmod 600, do NOT commit it)
+#      or wire it up to your organization's secret store.
+
+# identity_ad
+ad_join_username: "svc-linuxjoin"
+ad_join_password: "CHANGE_ME"
+
+# falcon_onboarding
+falcon_cid: "CHANGE_ME-CID-FROM-FALCON-CONSOLE"
+falcon_onboarding_provisioning_token: ""
+
+# cis_hardening: GRUB bootloader password
+# Generate the hash beforehand with: grub2-mkpasswd-pbkdf2
+# Only relevant if cis_grub_password_enabled: true
+grub_bootloader_password_hash: ""
+
+# local_accounts: the break-glass account password is intentionally NOT
+# managed here. Ansible only creates the account with a locked password
+# hash; set the real password manually on the host and store it in your
+# organization's password safe.