---
# Overrides for the "dmz" group (see hosts.ini).

cis_level: 2

firewall_allowed_services:
  - service: "https"
    source: "any"
  - service: "ssh"
    source: "{{ firewall_admin_subnet }}"

firewall_default_zone: "drop"