---
# Per-site values for pxe_server_setup.yml. Copy to playbook/site-vars.yml
# (next to the playbook, so it rides on the USB) and fill in. The playbook
# loads it on first boot; -e on the command line still overrides it.
# site-vars.yml is git-ignored: each site's MACs stay with that site.
#
# The NICs, by MAC (ip -br link on the box, or the label). Both optional:
#   pxe_nic_mac   imaging NIC = cable to the isolated imaging switch (serves
#                 DHCP/PXE/SMB). Empty: the first boot picks the one wired
#                 port with a link, if pxe-nic-check calls it isolated, and
#                 pins it. So during the install plug in ONLY the imaging
#                 switch. If it cannot tell, the console says to log in and
#                 run: sudo pxe-pick-nic (pull the imaging cable, plug it in).
#   corp_nic_mac  GE corporate NIC (SSH + webapp 9009). Empty: every other
#                 wired port is a DHCP client, so GE can be plugged into any
#                 of them, now or later. Set: only that port, named corp0.
pxe_nic_mac: ""     # e.g. "34:c8:d6:b1:10:10"
corp_nic_mac: ""    # e.g. "20:88:10:af:0d:e5"

# Optional: stable interface names (default pxe0 / corp0). With corp_nic_mac
# empty, pxe_nic_name must not start with en or eth. With both MACs set a
# box may keep its existing names, e.g. on the WJ server:
# pxe_nic_name: enx34c8d6b11010
# corp_nic_name: enp0s31f6

# Recommended: who may reach SSH and the webapp (9009) on the corp NIC.
# Empty = all of GE (a warning every run). See docs/SITE-CUSTOMIZATION.md.
# corp_admin_cidrs: ["10.12.34.0/24"]
# Keys only from the GE side (needs ~pxe/.ssh/authorized_keys first):
# corp_ssh_password_auth: false

# Optional: imaging LAN addressing (defaults shown). 172.16.9.1 is also
# hard-coded in the iPXE menu, startnet.cmd, blancco-preferences.xml and the
# unattend files; see docs/SITE-CUSTOMIZATION.md before changing it.
# pxe_server_ip: "172.16.9.1"
# pxe_subnet: "172.16.9.0/24"
# pxe_dhcp_start: "172.16.9.10"
# pxe_dhcp_end: "172.16.9.100"
# pxe_dhcp_lease: "12h"

# Optional: kernel the Blancco UEFI entries boot (must be installed; see
# scripts/download-packages.sh BLANCCO_KVER).
# blancco_kver: "7.0.0-34-generic"

# Recommended: the password of the Samba account "clonezilla", which can
# open only the [clonezilla] share (Clonezilla back up / restore by machine
# number). The iPXE menu carries it, so treat it as an imaging-LAN secret,
# not a real one. 8-64 characters from A-Z a-z 0-9 . _ ~ - (default
# "clonezilla-backup").
# clonezilla_smb_password: "change-me-per-site"

# Recommended: the site name stamped on Blancco erasure reports and the
# monthly CMMC evidence packs (empty: "Unnamed site"). Letters, digits,
# spaces and . , - ( ) & / only.
# site_name: "Example Site"
# Optional: time zone of the server clock and the webapp (tz database name).
# site_timezone: "America/New_York"