---
all:
  children:
    # define cluster
    ipacluster:
      children:
        ipaserver:
        ipareplicas:
        ipaclients:
      vars:
        ipaserver_domain: fed.ipa.test
        ipaserver_realm: FED.IPA.TEST
        ipadm_password: ""
        ipaadmin_password: ""
    # IPA First Server (CA Renewal) 
    ipaserver:
      hosts:
        server.fed.ipa.test:
          ansible_user: root
      vars:
        # KRA
        ipaserver_setup_kra: true
        # DNS
        ipaserver_setup_dns: true
        ipaserver_forwarders: 1.1.1.1
        ipaserver_auto_reverse: true
        ipaserver_allow_zone_overlap: true
        # this is required for AD trust
        ipaserver_no_dnssec_validation: true
        # trust vars
        ipaserver_setup_adtrust: true
        # disable 'allow all' HBAC rule
        ipaserver_no_hbac_allow: true
        # other vars
    # IPA Replica Servers
    ipareplicas:
      hosts:
        rep-01.fed.ipa.test:
          ansible_user: root
          # CA backup
          ipareplica_setup_ca: true
          # KRA backup
          ipareplica_setup_kra: true
          # DNS backup
          ipareplica_setup_dns: true
          ipareplica_no_dnssec_validation: true
          ipareplica_no_forwarders: true
          # Trust backup
          ipareplica_setup_trust: true
      vars:
        # Update DNS address
        ipasssd_enable_dns_updates: true
        # Automatically handle DNS nameservers (v1.9.0+)
        ipaclient_configure_dns_resolver: true
        ipaclient_dns_servers:
          # server.fed.ipa.test IPv4 address
          - 192.168.122.30
          # rep-01.fed.ipa.test IPv4 address
          - 192.168.122.31
    # IPA Client hosts
    ipaclients:
      hosts:
        cli-01.fed.ipa.test:
          ansible_user: root
      vars:
        # Client options
        ipaclient_mkhomedir: true
        # Update DNS address
        ipasssd_enable_dns_updates: true
        # Automatically handle DNS nameservers (v1.9.0+)
        ipaclient_configure_dns_resolver: true
        ipaclient_dns_servers:
          # server.fed.ipa.test IPv4 address
          - 192.168.122.30
          # rep-01.fed.ipa.test IPv4 address
          - 192.168.122.31