792dca976d
Adds meta/main.yml (Galaxy metadata for Ubuntu 22.04/24.04 under the Apache-2.0 license), defaults/main.yml covering the policy/storage/ firstrun/pending knobs the tasks layer will consume, and a single restart-daemon handler. Tasks and template land in the next commit. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
32 lines
1.3 KiB
YAML
32 lines
1.3 KiB
YAML
---
|
|
# Whether to additionally pull the GUI package. Headless fleets should leave
|
|
# this off; desktop fleets that want the AuthForge settings panel can flip it.
|
|
authforge_install_gui: false
|
|
|
|
# PPA to install from. Override if you mirror packages internally.
|
|
authforge_ppa: "ppa:dangerousthings/authforge"
|
|
|
|
# Map of stack name -> { mode, methods }. mode is one of
|
|
# "disabled" | "optional" | "required". methods is a list e.g. ["fido2", "totp"].
|
|
# Default is empty so the role can be applied for "install only" runs.
|
|
authforge_stacks: {}
|
|
|
|
# Credential storage backend. "per-user" stores credentials under each user's
|
|
# home directory; "central" stores them at authforge_storage_central_path so
|
|
# they survive home-directory wipes (e.g. AD-managed boxes).
|
|
authforge_storage_backend: "per-user"
|
|
authforge_storage_central_path: ""
|
|
|
|
# First-login enforcement. Users who exist in the pending list will be required
|
|
# to enroll one of these methods on their next interactive login.
|
|
authforge_firstrun_methods:
|
|
- "fido2"
|
|
|
|
# How long after the pending flag is set before the user is locked out if they
|
|
# have not enrolled. 0 means no deadline (warn forever).
|
|
authforge_firstrun_deadline_hours: 0
|
|
|
|
# Users to mark as pending-enrollment via `authforgectl pending set`.
|
|
# Each entry: { user: "alice", methods: ["fido2"] }.
|
|
authforge_pending_users: []
|