vars.yml (7889B)
1 # What environment are we deploying? 2 deployment_kind: "tops" 3 # Public variables for a "test" deployment 4 # Deploy challenger? 5 deploy_challenger: true 6 # No monitoring for rusty, 7 # monitoring stack will be replaced. 8 deploy_monitoring: false 9 # Main external domain name. 10 domain_name: "stage.taler-ops.ch" 11 # Our internal hostname 12 target_host_name: "rusty.taler-ops.ch" 13 # Suite for taler packages. 14 taler_repo_suites: trixie-testing 15 # Deploy EBICS configuration (true/false). 16 use_ebics: false 17 # Our currency. 18 currency: CHF 19 # Smallest unit of the currency for wire transfers. 20 currency_round_unit: "CHF:0.01" 21 # Sanction list to use, comment out to disable 22 sanction_list: sanctions-swiss.json 23 # Base URL of the exchange REST API 24 exchange_base_url: "https://exchange.{{ domain_name }}/" 25 # Base URL of the auditor REST API 26 auditor_base_url: "https://auditor.{{ domain_name }}/" 27 # Exchange offline master public key. 28 exchange_master_pub: GT1ZRF6DT4RAETDEGW3KTWRH15RAKH9T0TK6ZJEYFGRX18B54AK0 29 # Auditor offline public key. 30 auditor_pub: P6B7ZS7Y1Y12S0VP0PAJ1GQGSHW8RE4NSBTP8PR254J18SK24MH0 31 # URL with merchants accepting this exchange. 32 exchange_shopping_url: "https://shops.taler-ops.ch/" 33 # Name of Terms of service resource file 34 exchange_terms_etag: "exchange-tos-v0" 35 # Name of Privacy policy resource file 36 exchange_pp_etag: "exchange-pp-v0" 37 # Full BIC of exchange account 38 exchange_bank_account_bic: "MAEBCHZZ" 39 # Full Payto URI of exchange account (for credit and debit) 40 exchange_bank_account_iban: "CH6808573105529100001" 41 # QR IBAN for prepared transfers 42 exchange_qr_iban: "CH1130000001166556117" 43 # Full Payto URI of exchange account (for credit and debit) 44 exchange_bank_account_payto: "payto://iban/{{ exchange_bank_account_iban }}?receiver-name=Taler+Operations+AG" 45 # Port to be used by libeufin-nexus for the taler-exchange-wire-gateway 46 libeufin_port: 8082 47 # Name of the bank dialect 48 libeufin_nexus_bank_dialect: "maerki_baumann" 49 # SPA dialect (tops, gls, magnet, ...) 50 exchange_spa_dialect: "tops" 51 # Business name of the exchange operator 52 exchange_operator_legal_name: "Taler Operations AG" 53 # Where to send people after they passed KYC. 54 kyc_thank_you_url: https://taler-ops.ch/thank-you-kyc.html 55 # Template to use for identification of individuals with KYCAID 56 kycaid_template_individual: tmpl_xxx 57 # Template to use for identification of businesses with KYCAID 58 kycaid_template_business: tmpl_xxx 59 # Regex specifying allowed phone numbers for the SMS check 60 exchange_aml_program_tops_sms_hint: "Swiss number required" 61 exchange_aml_program_tops_sms_example: "+41948224521" 62 exchange_aml_program_tops_sms_regex: "\\\\+41[0-9]+" 63 # Regex specifying allowed country names for the postal address check 64 exchange_aml_program_tops_postal_country_hint: "Swiss address required" 65 exchange_aml_program_tops_postal_example: "Max Mustermann\\nBahnhofsplatz 1\\n4201 Biel/Bienne" 66 exchange_aml_program_tops_postal_country_regex: "CH|Ch|ch" 67 # Tool to use for sanction list checking 68 exchange_sanction_helper: taler-exchange-helper-sanctions-dummy 69 70 # If set to true, set up an additional user to allow faking wire transfers and 71 # inspecting challenger auth codes. 72 # This setting MUST NOT be enabled in production 73 # deployments under any circumstance. 74 dangerously_enable_devtesting: true 75 76 # MFA challenge messages are written to /var/www/mock-mfa and served at 77 # https://exchange.{{ domain_name }}/mock-mfa/. Never enable this on a 78 # production system. 79 devtesting_mock_mfa: true 80 81 devtesting_ssh_keys: 82 - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINHSjJ/zPwQnqBrKp0qK+OdsZYfQ8DHY2dyJakNozBi7 fdold-work@sapota" 83 - "ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAoXKfSbPriOPoFRR+lMAJszH0/7jaPZOxdg85/URlRbe0ljm8fxbVmup1EjGPuKKJkyYqJIqGQCRHPNYeBt05APXYEO+4d5WAuPY6QOiTFGxB5RueWHAjFM5LVKtBH9Ozln+ngjeXlID48ueuBY2LO24hRuZtRmHYKN1AwQNA2XKtjteKINx99ljm3uwVV9IDYAJkRWKllolLrSFfqK6CHDS/IqlMNp3qNNhNXEW+/Vm5kMUPzKvhPXH/OsFr2KyKaO/+zVXptwje9imtaYaD5iEuRbEfP+6OsCKKpIlp6kyfOUPLuxK+RQfDRY3pyHeCKGriv3DGUpCYqtFVZlmsww== stibane@feh.com" 84 - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPzMFKrnSNsRwS6eBInPx4WrJipQvsxFKNN48TGwXewb avalos@thinkpad" 85 - "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDftpehk0olHW7h0z8u401gjEZwAw4gKjfy/WXfr1xP4aUlAmHlEybrwCA1TmLzYiuJ1GiEZC1a8s/pk4EFXDd1/YH/mMKnqb7FkFM78lsmpyF+uj9lWzGE/Ov0y8ypdS/V+54CGymPvpnZ2v9x/bvADrQip8qnDPu49ERbrr0/3xm4zT+s2uWh8878crJpzjcOnR5WxwTSyl/H1/uSC/8sGhK49sscwgyvemVL13tpqy5svVB6/7Epno8Gti/ydmy9bd3gl9CtBZvRqZ/0gMefWFaKrkyqtu7mwn7xpsth4izKCaJ5QKOVFo/7ZpqyuderUT7UEC0Opm72q8GR8bvS9aFXjMf3XlE4yrQ6NtHR8h7GpvqWkFsmKuSC5JdpPCMu2a8QtQ9RfCxoCv7JG2En2zJwg8ugek8Q9mKxC0RXl0IeOokm4SnoZWQ6smgJezTx8w3Jv2zOPkWX0jAwtGpPHnPlOleqLcdIqkYpbre/91K5527Sz2HvzZiyjScY13Q++YEiHBZ6xEhzSvbQ6FmV0k6zPhijayx8OyqHDp+PjFVGGOYRoRrN1vQTAJAgXxKrL/7QzdGb+920aeYdrxcVS1fp9xvnwUSM6nf9QobjYDcyFdbKRGo/Yn9KKpWR86ksGAy8m1dImvzv/mG7JP02cS1KqLmBSonzBh9KLUHs/Q== hernani+clementine@vecirex.net" 86 - "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCeYL0JLzvDQXyUqzEn+QlOsxyVPmSedSK1SZxUzM/mBgGBJLRA6kN9Go9X9YeVLsPRJZjCOeLaZqZE3CbSUtw9m7/QYSHZslm+9ALlCJwqGeurFXeqWZ4HTo6/IqD79D+RJezYfnNI8QlKe/ChoIGSf+OHpuc5I5FkNRlKTWfTr+pq8/VFqziRqTTT/LkrtBhflvRYsLnz7X/7nMRrIHi+16SeOFxmT0kwTkl6cYnoGPtaV/FmZaWDYbE+QV4wxnWYbkBNu9CZei2b6t9ZITAJeB9S3VvHF3cvzes1mwz4lwItckmesQ/IY4E7KGu1QN5l3r1Ug0JC/BoZe8qnVQw5 stefan-kuegel" 87 - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGjBjN7/7f7nloHLScOrZwrwe6HYb3MybDTDbmLxyrds hernani+magikoopa@vecirex.net" 88 - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKzazWynkrZY/TFkFrUAR1NUsAQSdcw9bJUmAegW0+g+ sebasjm" 89 - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIimpYb9AnfuPby4RhjQkzBy+tu0WghUWoih8EZhbaoM taler-monitoring@betel" 90 - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAX0VOA15Kf7z7kq9L1FL2MDupa85ufDThrBebHkCuQS fdold-agent@salak" 91 - "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINBcyb8PbUae+hNuT2R38oIZue3J3WoMmGwZmKGPYODX claude@phoenix" 92 93 # Secrets are taken from the vault file and substituted via 94 # the vault_* variables. 95 # 96 # YOU MAY ONLY edit the vault.yml file via 97 # $ ansible-vault edit inventories/host_vars/rusty/vault.yml 98 # to decrease the likelihood of unencrypted secrets ending up in git. 99 # Symmetric encryption secret for KYC attribute encryption. 100 exchange_attribute_encryption_key: "{{ vault_exchange_attribute_encryption_key }}" 101 # EBICS access details 102 libeufin_nexus_ebics_host_base_url: https://ebics.postfinance.ch/ebics/ebics.aspx 103 libeufin_nexus_ebics_host_id: PFEBICS 104 libeufin_nexus_ebics_user_id: "{{ vault_libeufin_nexus_ebics_user_id }}" 105 libeufin_nexus_ebics_partner_id: "{{ vault_libeufin_nexus_ebics_partner_id }}" 106 libeufin_nexus_ebics_system_id: "{{ vault_libeufin_nexus_ebics_system_id }}" 107 108 # Authorization token for the telesign SMS service 109 # "Basic" is pre-pended by the shell script 110 sms_challenger_telesign_auth_token: "{{ vault_sms_challenger_telesign_auth_token }}" 111 112 sms_challenger_clicksend_username: "{{ vault_sms_challenger_clicksend_username }}" 113 sms_challenger_clicksend_api_key: "{{ vault_sms_challenger_clicksend_api_key }}" 114 115 sms_challenger_aspsms_apikey: "{{ vault_sms_challenger_aspsms_apikey }}" 116 sms_challenger_aspsms_password: "{{ vault_sms_challenger_aspsms_password }}" 117 118 # Authorization data for the pingen postal service 119 postal_challenger_pingen_client_id: "{{ vault_postal_challenger_pingen_client_id }}" 120 postal_challenger_pingen_client_secret: "{{ vault_postal_challenger_pingen_client_secret }}" 121 postal_challenger_pingen_org_id: "{{ vault_postal_challenger_pingen_org_id }}" 122 123 # KYCaid access token 124 exchange_kycaid_access_token: "{{ vault_exchange_kycaid_access_token }}" 125 126 # Bearer access token for the auditor SPA (set via browser extension to set Authorization HTTP header on auditor.$DOMAIN!) 127 auditor_access_token: "{{ vault_auditor_access_token }}" 128 129 # Bearer access token for monitoring.$DOMAIN (must be given to grafana) 130 prometheus_access_token: "{{ vault_prometheus_access_token }}" 131 132 # Bearer access token for loki.taler-systems.com (see that nginx config) 133 loki_access_token: "{{ vault_loki_access_token }}"