Inventory and Variables

Inventory and Variables

Inventory groups

The inventory is inventories/production/hosts.yaml.

Group	Required for	Receives
bootstrap	First user creation	users during bootstrap.
traefik_hosts	Proxy and every application host	Docker, Traefik, TCP 80/443 firewall rules, Traefik CrowdSec collection.
vaultwarden_hosts	Vaultwarden	Vaultwarden role. Also requires traefik_hosts.
three_x_ui_hosts	3x-ui	3x-ui role. Also requires traefik_hosts.
telemt_hosts	Telemt	Telemt role. Also requires traefik_hosts.

Example for one proxy and Vaultwarden host:

---
all:
  children:
    bootstrap:
      hosts:
        server-01:
          ansible_host: 203.0.113.10
          ansible_user: root
    traefik_hosts:
      hosts:
        server-01:
    vaultwarden_hosts:
      hosts:
        server-01:
    three_x_ui_hosts:
      hosts: {}
    telemt_hosts:
      hosts: {}

The initial ansible_user must be root or another sudo-capable account. Bootstrap changes later playbook connections to bootstrap_login_user_name.

Where variables belong

Location	Use it for
group_vars/all.yaml	Safe baseline values for every host.
group_vars/traefik_hosts.yaml	Proxy-specific values and ports.
group_vars/vaultwarden_hosts.yaml	Vaultwarden domains and non-secret defaults.
group_vars/three_x_ui_hosts.yaml	3x-ui panel and inbound configuration.
group_vars/telemt_hosts.yaml	Telemt SNI and non-secret values.
host_vars/<host>.yaml	A value that applies to one host only.
group_vars/vault.yaml	Secrets only; encrypted and ignored by Git.

The production inventory has group_vars and host_vars symlinked from the repository root. Keep those links. They let Ansible discover group values at normal inventory precedence.

Important baseline values

The current defaults in group_vars/all.yaml include:

bootstrap_manage_updates: true
bootstrap_reboot_timeout: 1800
bootstrap_login_user_name: bootstraper
bootstrap_login_user_groups:
  - sudo
bootstrap_login_user_sudo_nopasswd: true
bootstrap_login_user_force_password_change: false

ssh_hardening_port: 22571
setup_ssh_port: "{{ ssh_hardening_port }}"
ssh_hardening_current_port: "{{ setup_ssh_port }}"

iptables_open_tcp_ports:
  - "{{ ssh_hardening_port }}"
iptables_open_udp_ports: []

traefik_hosts overrides the TCP ports to include 80 and 443.

Per-host override example

Use host_vars/server-01.yaml if one server needs a different hardened SSH port:

---
ssh_hardening_port: 2223

Before applying this, open TCP 2223 in the provider firewall and run setup with the old current port:

uv run ansible-playbook playbooks/setup.yaml \
  -e 'setup_ssh_port=22571' \
  -e 'ssh_hardening_port=2223'

Inspect resolved inventory

Never guess whether a host is in a group:

uv run ansible-inventory --graph
uv run ansible-inventory --host server-01

Do not paste the output of --host into tickets or chat if it contains secrets.