# CarbonFish Configuration Example
# Copy this file to config.yml and customize with your actual values
# This will silence all prompts in lamp.sh, harden.sh, and mysql57.sh

# LAMP Stack Configuration
mysql_root_password: "SecureP@ssw0rd2024!"
mysql_root_password_current: ""
timezone: "America/New_York"
web_server: "nginx" # nginx only (legacy "apache" in old configs is treated as nginx)
php_versions: "8.2,8.3,8.4"
default_php_version: "8.4"

# Server Hardening Configuration
allowed_ip: "192.168.1.100"

# ModSecurity CRS Configuration
install_modsecurity_crs: "yes"
modsecurity_mode: "DetectionOnly"

# Fail2ban jails for UFW blocks + nginx ModSecurity (Debian/Ubuntu with UFW; lamp.yaml / harden.yml)
install_fail2ban_carbonfish: "yes"
# Optional extra CIDRs for fail2ban ignoreip (space-separated), e.g. your office IP
# fail2ban_carbonfish_ignoreip_extra: "203.0.113.10"

# MySQL 5.7 Configuration
mysql57_root_password: "MySQL57SecureP@ss!"

# Node.js Configuration
install_nodejs: "yes"
nodejs_versions: "18,20,22"
default_nodejs_version: "20"

# Docker Engine on the host (docker_install.yml). Debian/Ubuntu only. Used with unit test Docker stacks.
# Optional: users who may run docker without sudo (log out/in after apply)
# docker_users_to_group: ["ubuntu", "deploy"]
# When "yes", ./bin/setup-docker-for-tests.sh and bootstrap run docker_install.yml before building test images.
install_docker_engine_for_tests: "no"

# Docker test stacks (see docker_test_stacks*.yml): images built at setup; containers run only during tests by default
docker_test_prepare_images: "yes"
docker_test_ensure_stacks: "yes"
# After unit/integration pass, docker compose down test stacks to free memory (run-tests.sh / bin/run-unit.sh)
docker_test_stop_after_tests: "yes"
# Optional: docker compose up -d --build when starting stacks for tests (default no — use images from prepare)
docker_test_rebuild_when_starting: "no"

server_domain: "yourserver.com"

# Dashboard Configuration
install_dashboard: "yes"
dashboard_port: "8001"
dashboard_admin_user: "admin"
dashboard_admin_password: "SecureAdminP@ss!"
dashboard_become_password: ""
dashboard_subdomain: "dashboard"
# Let's Encrypt for dashboard vhost: set "no" for IP-only / HTTP access until DNS exists
provision_dashboard_ssl: "yes"

# Server Scaling Configuration (optional overrides)
# server_profile: "medium"     # Force specific profile
# mysql_ram_percent: 0.7       # Use 70% of RAM for MySQL
# php_memory_per_process: 60   # 60MB per PHP process