computer-playbook/group_vars/all/08_networks.yml

---
NETWORK_IPV6_ENABLED: false
NETWORK_PUBLIC_DNS_RESOLVERS:
  - 1.1.1.1 # nocheck: hardcoded-dns-resolver
  - 8.8.8.8 # nocheck: hardcoded-dns-resolver
  - 1.0.0.1 # nocheck: hardcoded-dns-resolver
NETWORK_DOCKER_EMBEDDED_DNS_RESOLVER: "127.0.0.11" # nocheck: hardcoded-dns-resolver
NETWORK_DNS_PORT: 53 # Well-known resolver port a host DNS listener binds
NETWORK_DOCKER_DNS_NGINX_DIRECTIVE: "resolver {{ NETWORK_DOCKER_EMBEDDED_DNS_RESOLVER }} valid=30s ipv6={{ NETWORK_IPV6_ENABLED | on_off }};"
NETWORK_LOOPBACK_CIDR: "127.0.0.0/8"
NETWORK_PRIVATE_CIDRS:
  class_a: "10.0.0.0/8"
  class_b: "172.16.0.0/12"
  class_c: "192.168.0.0/16"
NETWORK_INTERNAL_CIDRS: "{{ [NETWORK_LOOPBACK_CIDR] + (NETWORK_PRIVATE_CIDRS.values() | list) }}"
NETWORK_ROLE_SUBNET_POOL: "{{ NETWORK_PRIVATE_CIDRS.class_c }}"
NETWORK_ROLE_SUBNET_EXCEPTION_ROLES:
  - web-app-bigbluebutton
NETWORK_SWARM_GWBRIDGE_POOL: "{{ NETWORK_PRIVATE_CIDRS.class_b }}"
NETWORK_TRUSTED_PROXY_CIDRS: "{{ ['127.0.0.1', '::1'] + (NETWORK_PRIVATE_CIDRS.values() | list) }}"
NETWORK_DOCKER_ADDRESS_POOLS:
  - base: "10.208.0.0/12"
    size: 24
NETWORK_TOR_VIRTUAL_CIDR: "10.240.0.0/12" # Range tor answers for .onion instead of routing; must not overlap the pool above
NETWORK_MESH_POOL: "10.100.0.0/16" # Range every WireGuard mesh subnet is carved from
NETWORK_CONTAINER_BRIDGE_RESOLVER: false
NETWORK_NESTED_DOCKER_BIP: "192.168.67.1/24"
NETWORK_NESTED_DOCKER_ADDRESS_POOLS:
  - base: "192.168.68.0/22"
    size: 24
defaults_networks:
  internet:
    ip4: "127.0.0.1"
    ip6: "::1"
    dns: ""
PORT_BANDS: # nocheck: unused-var  # consumed by the port-allocation plugin outside the YAML/Jinja scope
  local:
    http:
      start: 8001
      end: 8099
    agent:
      start: 8500
      end: 8599
    websocket:
      start: 4001
      end: 4099
    sso:
      start: 16480
      end: 16519
    mariadb:
      start: 3306
      end: 3306
    postgres:
      start: 5432
      end: 5432
    redis:
      start: 6379
      end: 6379
    memcached:
      start: 11211
      end: 11211
    rabbitmq:
      start: 5672
      end: 5672
    typesense:
      start: 8108
      end: 8108
    qdrant:
      start: 6333
      end: 6333
    elasticsearch:
      start: 9200
      end: 9200
    ldap:
      start: 389
      end: 389
    unbound:
      start: 53
      end: 53
    registry:
      start: 5000
      end: 5001
    socks:
      start: 9050
      end: 9050
    trans:
      start: 9040
      end: 9040
    dns:
      start: 9053
      end: 9053
  public:
    http:
      start: 80
      end: 80
    https:
      start: 443
      end: 443
    ssh:
      start: 2201
      end: 2299
    media:
      start: 10000
      end: 10099
    stun_turn:
      start: 3478
      end: 3499
    stun_turn_tls:
      start: 5349
      end: 5399
    federation:
      start: 8448
      end: 8499
    ldaps:
      start: 636
      end: 636
    relay:
      start: 20000
      end: 65535
    smtp:
      start: 25
      end: 25
    smtps:
      start: 465
      end: 465
    submission:
      start: 587
      end: 587
    pop3:
      start: 110
      end: 110
    pop3s:
      start: 995
      end: 995
    imap:
      start: 143
      end: 143
    imaps:
      start: 993
      end: 993
    sieve:
      start: 4190
      end: 4190
    rtmp:
      start: 1935
      end: 1935
    c2s:
      start: 5222
      end: 5222
    s2s:
      start: 5269
      end: 5269