# SPDX-Version: 3.0
# SPDX-CreationInfo: 2025-06-17; WEIDNER, Marc S.; <msw@coresecret.dev>
# SPDX-ExternalRef: GIT https://git.coresecret.dev/msw/CISS.debian.installer.git
# SPDX-FileContributor: WEIDNER, Marc S.; Centurion Intelligence Consulting Agency
# SPDX-FileCopyrightText: 2024-2025; WEIDNER, Marc S.; <msw@coresecret.dev>
# SPDX-FileType: SOURCE
# SPDX-License-Identifier: EUPL-1.2 OR LicenseRef-CCLA-1.0
# SPDX-LicenseComment: This file is part of the CISS.debian.installer.secure framework.
# SPDX-PackageName: CISS.debian.installer
# SPDX-Security-Contact: security@coresecret.eu
%YAML 1.2
---
### This file contains configurations for the CISS.debian.installer
### Master V8.00.000.2025.06.17
### YAML specification: 1.2

installer:
  name: "CISS.debian.installer"
  version: "V8.00.000.2025.06.17"
  log: "info"

################################################################################################################################
# APT settings
################################################################################################################################
apt:
  contrib: true                # Optionally install contrib software.
  deb_sources: true            # Optionally includes deb-src entries for source repositories.
  default_list: true           # By default, source repositories are listed in '/etc/apt/sources.list'. This MUST be "true".
  full_upgrade: true           # Whether to upgrade packages after debootstrap.
  install_recommends: true     # Configure APT to not install recommended packages by default.
  non_free: true               # Optionally install non-free software.
  non_free_firmware: true      # Optionally install non-free firmware. MUST be "true" for microcode updates.
  sec: "security.debian.org"   # Debian Security Updates Archive.

  ##############################################################################################################################
  # A network mirror MUST be used to supplement the software not included on the installation media. This may also make newer
  # versions of software available.
  ##############################################################################################################################
  mirror:
    activate: true             # MUST be "true".
    country: "US"              # Country code of mirror destination.
    directory: "/debian/"      # Debian archive mirror directory in which the mirror of the Debian archive is located.
    hostname: "deb.debian.org" # Debian archive mirror hostname.
    https-country: "US"        # Debian archive mirror country.
    protocol: "https"          # Protocol to be used for downloading files, where "https" is RECOMMENDED.
    proxy: ""                  # HTTP proxy information (blank for none) or "http://[[user][:pass]@]host[:port]/"

  ##############################################################################################################################
  # Debian has the following services that provide updates.
  #
  # Backported software is adapted from the development version to work with this release. Although this software has not gone
  # through such complete testings as that contained in the release, it includes newer versions of some applications that may
  # provide useful features. Enabling backports here does not cause any of them to be installed by default; it only allows you
  # to manually select backports to use.
  #
  # Release updates provide more current versions for software that changes relatively frequently and where not having the
  # latest version could reduce the usability of the software. It also provides regression fixes. This service is only
  # available for stable and oldstable releases.
  #
  # Security updates help to keep your system secured against attacks. Enabling this service is strongly recommended.
  #
  # Applying updates on a frequent basis is an important part of keeping the system secure. By default, security updates are not
  # automatically installed, as security advisories should be reviewed before manual installation of the updates using standard
  # package management tools.
  #
  # Alternatively, the unattended-upgrades package can be installed, which will install security updates automatically. Note,
  # however, that automatic installation of updates may occasionally cause unexpected downtime of services provided by this
  # machine in the rare cases where the update is not fully backward-compatible, or where the security advisory requires the
  # administrator to perform some other manual operation. Possible choices: "none", "security", "unattended" (RECOMMENDED)
  ##############################################################################################################################
  updates:
    backports: true
    release: true
    security: true
    policy: "unattended"

################################################################################################################################
# Basic settings
################################################################################################################################
architecture: "amd64"          # MUST be one of "amd64", "intel64" or "arm64".
distribution: "bookworm"       # MUST be "bookworm".
debian_suite: "stable"         # MUST be "stable". Not supported yet: "testing", "experimental".
exit:
  halt: false                  # This is how to make the installer shutdown when finished, but not reboot.
  poweroff: true               # This will power off the machine instead of just halting it (RECOMMENDED).
  reboot: false                # This will reboot the machine.
firmware:
  install: true                # If non-free firmware is needed for the network or other hardware, autoinstall it.
  lookup: "missing"            # - "never"   Completely disables the firmware search.
    # - "missing" Searches only when the firmware is needed. (default)
  # - "always"  Always searches and asks for any firmware that could be useful for the hardware.
image: "linux-image-amd64"     # Could be a meta-package or a specific image like:
                               # "linux-image-amd64" || "linux-image-arm64"
                               # "linux-image-cloud-amd64" || "linux-image-cloud-arm64"
                               # "linux-image-rt-amd64" || "linux-image-rt-arm64"
                               # "linux-image-6.12.30+bpo-amd64"

################################################################################################################################
# GRUB2 settings
################################################################################################################################
grub:
  background:                  # RECOMMENDED settings: JPG 1280 x 1024 px or JPG 1920 x 1080 px
    enable: true               # If you want to add a GRUB background.
    path: "/root/CISS.2025.debian.installer/.assets/background/background_hexagon_1280.jpg"
  bootdev: "/dev/sda"          # Due notably to potential USB sticks, the location of the primary drive cannot be determined
                               # safely in general, so this needs to be specified.
  force_efi: false             # Force GRUB installation to the EFI removable media path?
                               # It seems that this computer is configured to boot via EFI, but maybe that configuration will
                               # not work for booting from the hard drive. Some EFI firmware implementations do not meet the
                               # EFI specification (i.e., they are buggy) and do not support proper configuration of boot
                               # options from system hard drives.
                               #
                               # A workaround for this problem is to install an extra copy of the EFI version of the GRUB
                               # bootloader to a fallback location, the "removable media path". Almost all EFI systems, no
                               # matter how buggy, will boot GRUB that way.
                               #
                               # Warning: If the installer failed to detect another operating system that is present on your
                               # computer that also depends on this fallback, installing GRUB there will make that OS
                               # temporarily unbootable. GRUB can be manually configured later to boot it if necessary.
  latest: true                 # Install the latest GRUB2 backported package for encrypted '/boot' support.
                               # MUST be "true" in the case of 'LUKS2' and / or 'dm-integrity' encrypted '/boot'
  only_debian: true            # This is fairly safe to set; it makes grub install automatically to the UEFI partition '/boot'
                               # record if no other operating system is detected on the machine.
  other-os: true               # This one makes grub-installer install to the UEFI partition '/boot' record if it also finds
                               # some other OS, which is less safe as it might not be able to boot that other OS.
  prober: false                # OS-prober did not detect any other operating systems on your computer at this time, but you
                               # may still wish to enable it in case you install more in the future.
  skip: false                  # Skip installing grub.
  update_nvram: true           # Update NVRAM variables to automatically boot into Debian?
                               # GRUB can configure your platform's NVRAM variables so that it boots into Debian automatically
                               # when powered on. However, you may prefer to disable this behavior and avoid changes to your
                               # boot configuration. For example, if your NVRAM variables have been set up such that your
                               # system contacts a PXE server on every boot, this would preserve that behavior:

################################################################################################################################
# Locale settings set language, country, locale, keyboard map and timezone
################################################################################################################################
locale:
  country: "US"
  keyboard:
    layout: "de"
    xkb-keymap: "de"
  language: "en"
  locale: "en_US.UTF-8"
  timezone: "Europe/Lisbon"

################################################################################################################################
# Network settings
################################################################################################################################
network:
  autoconfig:
    enable: true               # Automatic network configuration 'dhcp' is the default. If you prefer to configure the network
                               # manually, change 'network.autoconfig.enable' from "true" to "false" and configure
                               # - 'network.choose_interface.static'
                               # - 'network.hostname'
                               # - 'network.ipv6'
                               # - 'network.static' section
  choose_interface:
    auto: true                 # Choose an interface that has a link if possible. Or manually configure the static NIC below.
    static: "eth1"             # For manual configuration, specify a particular interface.
  hostname: "nsa.usic.gov"     # Specify the FQDN of the server.
                               # If not specified and autoconfig is enabled, the given dhcp value is chosen.
  ipv6: true                   # Specify if you want to use IPv6.
  timeout:
    dhcp: 60                   # If the dhcp server is slow, and the installer times out waiting for it, this might be useful.
    linkwait: 60               # To set a different link detection timeout (default is 3 seconds).
  static:
    enable: true               # If you want the preconfiguration file to work on systems both with and without a dhcp
                               # server, change 'network.static.enable' from "false" to "true" and configure the static
                               # configuration below.
    ipv4address: "192.168.128.128"
    ipv4netmask: "255.255.255.0"
    ipv4gateway: "192.168.128.254"
    ipv4nameserver:
      - "135.181.207.105"      # dns01.eddns.eu
      - "89.58.62.53"          # dns02.eddns.de
      - "138.199.237.109"      # dns03.eddns.eu
    ipv4nameserver_fallback:
      - "176.9.93.198"         # dnsforge.de
      - "176.9.1.117"          # dnsforge.de
    ipv6address: "2a0a:aaaa:bbbb:cccc:192:168:128:128"
    ipv6netmask: "128"
    ipv6gateway: "fe80::1"
    ipv6nameserver:
      - "2a01:4f9:c012:a813:135:181:207:105"
      - "2a0a:4cc0:1:e6:89:58:62:53"
      - "2a01:4f8:c013:8011:138:199:237:109"
    ipv6nameserver_fallback:
      - "2a01:4f8:151:34aa::198"
      - "2a01:4f8:141:316d::117"

################################################################################################################################
# Security settings
################################################################################################################################
security:
  unauthenticated: false       # The installer will ensure that any packages are signed and authenticated.
  unauthenticated_ssl: false   # This ensures that the connection between the installer, and the server from which files
                               # are downloaded, is encrypted and signed by a trusted certificate authority.

################################################################################################################################
# Software installation
################################################################################################################################
software:
  ##############################################################################################################################
  # core software
  ##############################################################################################################################
  - apt-show-versions
  - apt-transport-https
  - apt-utils
  - bash
  - bash-completion
  - bat
  - bind9-dnsutils
  - bc
  - ca-certificates
  - coreutils
  - debconf
  - debconf-utils
  - dialog
  - efibootmgr
  - fzf
  - gawk
  - git
  - grub2
  - grub2-common
  - knot-dnssecutils
  - knot-dnsutils
  - libpam-google-authenticator
  - libpam-pwquality
  - locate
  - logrotate
  - lsb-release
  - nano
  - openssl
  - rsyslog
  - screen
  - shellcheck
  - software-properties-common
  - spectre-meltdown-checker
  - ssh
  - sudo
  - sysstat
  - tree
  #- unattended-upgrades
  - whois
  - zsh
  ## software dev
  #- build-essential
  #- clang
  #- debootstrap
  #- linux-source
  #- lld
  #- makedev
  #- ssl-cert
  ##############################################################################################################################
  # documentation
  ##############################################################################################################################
  - debian-kernel-handbook
  - linux-doc-6.12
  - man-db
  ##############################################################################################################################
  # encryption
  ##############################################################################################################################
  - dirmngr
  - gnupg
  - haveged
  - pollinate
  ##############################################################################################################################
  # files
  ##############################################################################################################################
  - curl
  - rsnapshot
  - rsync
  - unzip
  - wget
  - zip
  ##############################################################################################################################
  # malware detection
  ##############################################################################################################################
  - chkrootkit
  - clamav
  - clamav-daemon
  - rkhunter
  ##############################################################################################################################
  # network
  ##############################################################################################################################
  - dhcpdump
  - dhcping
  - iftop
  - iproute2
  - iputils-ping
  - mtr
  - ncat
  - net-tools
  - nmap
  - tshark
  - ufw
  ##############################################################################################################################
  # parser
  ##############################################################################################################################
  #- jq
  #- yq
  ##############################################################################################################################
  # partitioning
  ##############################################################################################################################
  - btrfs-progs
  - cryptsetup
  - cryptsetup-nuke-password
  - dmsetup
  - dosfstools
  - fdisk
  - gdisk
  - lvm2
  - mdadm
  - parted
  ##############################################################################################################################
  # password
  ##############################################################################################################################
  - keychain
  - makepasswd
  - pwgen
  - wamerican
  - wbritish
  - wfrench
  - wngerman
  ##############################################################################################################################
  # security
  ##############################################################################################################################
  - fail2ban
  ##############################################################################################################################
  # tools
  ##############################################################################################################################
  - expect
  - figlet
  - htop
  - neofetch
  - neovim
  - python3
  - virt-what

################################################################################################################################
# Time settings
################################################################################################################################
# Germany     : https://www.ptb.de/cms/ptb/fachabteilungen/abtq/gruppe-q4/ref-q42/zeitsynchronisation-von-rechnern-mit-hilfe-des-network-time-protocol-ntp.html
# Germany     : ptbtime1.ptb.de ptbtime2.ptb.de ptbtime3.ptb.de
# Germany     : https://www.rrze.fau.de/serverdienste/infrastruktur/zeitserver/
# Germany     : ntp0.fau.de	ntp3.fau.de
# Portugal    : https://si.tecnico.ulisboa.pt/en/servicos/servidores-e-dados/ntp/
# Portugal    : ntp1.tecnico.ulisboa.pt ntp2.tecnico.ulisboa.pt
# Sweden      : https://www.netnod.se/swedish-distributed-time-service
# Sweden      : nts.netnod.se
# Switzerland : https://www.metas.ch/metas/de/home/fabe/zeit-und-frequenz/time-dissemination.html
# Switzerland : ntp11.metas.ch ntp12.metas.ch ntp13.metas.ch
# USA         : https://tf.nist.gov/tf-cgi/servers.cgi
# USA         : time-a-g.nist.gov time-c-b.nist.gov utcnist3.colorado.edu
ntp:
  server:
    - "ntp.ripe.net"
    - "ptbtime3.ptb.de"
    - "ptbtime2.ptb.de"
    - "ptbtime1.ptb.de"
    - "ntp13.metas.ch"
    - "ntp2.tecnico.ulisboa.pt"
    - "time-c-b.nist.gov"
    - "sth1.ntp.se"
    - "ntp0.fau.de"
  timezone: "Europe/Lisbon"    # Any valid setting for $TZ; see the contents of '/usr/share/zoneinfo' for valid values.
  utc: true                    # Controls whether the hardware clock is set to UTC.

################################################################################################################################
# User settings
################################################################################################################################
user:
  allow_policies: true         # For additional hardening of SSH connections '/etc/hosts.allow'.
                               # If "allow_policies" = "true", at least one 'bastion_ipv4' MUST be provided.
                               # One or multiple Domains could be provided as well 'allow_domain'.
  bastion_enable: false        # In case 'bastion_ipv4' and 'bastion_ipv6' are SSH Bastion IPs set this to "true".
                               # If these are Jump Server and / or static VPN-Exit-Nodes, set this to "false".
  bastion_ipv4:                # Provide Bastion / Jump-Server / static VPN-Exit-Nodes IPv4.
    - 202.61.246.50
  bastion_ipv6:                # Provide Bastion / Jump-Server / static VPN-Exit-Nodes IPv6.
    - 2a03:4000:53:f:abcd:9494:0:2
  allow_domain:                # Provide Bastion / Jump-Server / static VPN-Exit-Nodes Domains.
    - vpn00.x448.eu
  dropbear_boot: true          # Dropbear initramfs integration.
  dropbear_dhcp: true          # Whether the '/etc/initramfs-tools/conf.d/ip' file should be configured statically or via DHCP.
  dropbear_fw: true            # Additional ultra hardening of the dropbear initramfs environment via firewall.
                               # The "bastion_ipv4" MUST be provided.
  ssh_port: 42137              # SSH Port. In case "dropbear_boot" = "true" the same SSH Port will be used.
  ssh_rootca: "/.preseed/ssh_root_ca.pub"

  ##############################################################################################################################
  # root – Superuser account (normally disabled for direct login)
  ##############################################################################################################################
  root:
    ensure: present            # Must always be 'present'.
    protected: true            # Prevent unintentional edits or deletions.
    shell: /bin/zsh            # Login shell (e.g., '/bin/bash', '/bin/zsh'); use '/usr/sbin/nologin' for non-interactive users.
    password: ""
    ssh_pubkeys:               # List of public SSH keys for authentication.
      - ""
    authentication:
      access:
        ssh: false             # Allow SSH access.
        tty: true              # Allow TTY (local console) login.
      password_auth:
        ssh: false             # Allow SSH password login.
        tty: true              # Allow TTY (local console) password login.
      2fa:
        ssh: false             # Require 2FA for SSH access.
        tty: true              # Require 2FA for TTY (local console) login.
    privileges:
      description: "Root user with full system access and administrative privileges."
      sudo: false              # Whether the user can escalate to root using sudo.
      system_user: false       # Whether this is a low-UID system user (e.g., for automation).
      restricted: false        # If true, user is limited in scope (e.g., no login, no file access).
      shell_access: true       # MUST be "true" if shell is not '/usr/sbin/nologin' or '/bin/false'.

  ##############################################################################################################################
  # Primary administrative user with full sudo access
  ##############################################################################################################################
  user0:
    ensure: present            # "present" = create user; "absent" = remove user
    protected: true            # Prevent unintentional edits or deletions.
    name: "msw"                # The name of the user account.
    fullname: "msw"            # The full name of the user account holder.
    uid: 1000                  # Ensures that the same user has the same UID on all systems.
    gid: 1000                  # Ensures that the same user has the same GID on all systems.
    shell: /bin/zsh            # Login shell (e.g., '/bin/bash', '/bin/zsh'); use '/usr/sbin/nologin' for non-interactive users.
    password: ""
    ssh_pubkeys:               # List of public SSH keys for authentication.
      - ""
    authentication:
      access:
        ssh: true              # Allow SSH access.
        tty: true              # Allow TTY (local console) login.
      password_auth:
        ssh: false             # Allow SSH password login.
        tty: true              # Allow TTY (local console) password login.
      2fa:
        ssh: true              # Require 2FA for SSH access.
        tty: true              # Require 2FA for TTY (local console) login.
    privileges:
      description: "Primary admin user with full sudo access and interactive login."
      sudo: true               # Whether the user can escalate to root using sudo.
      system_user: false       # Whether this is a low-UID system user (e.g., for automation).
      restricted: false        # If true, user is limited in scope (e.g., no login, no file access).
      shell_access: true       # MUST be "true" if shell is not '/usr/sbin/nologin' or '/bin/false'.

  ################################################################################
  # ansible – System user for automation, no interactive shell
  ################################################################################
  user1:
    ensure: present            # "present" = create user; "absent" = remove user
    protected: true            # Prevent unintentional edits or deletions.
    name: "ansible"            # The name of the user account.
    fullname: "ansible"        # The full name of the user account holder.
    uid: 137                   # Ensures that the same user has the same UID on all systems.
    gid: 137                   # Ensures that the same user has the same GID on all systems.
    shell: /usr/sbin/nologin   # Login shell (e.g., '/bin/bash', '/bin/zsh'); use '/usr/sbin/nologin' for non-interactive users.
    password: ""               # No password set for ansible user
    ssh_pubkeys:               # List of public SSH keys for authentication.
      - ""
    authentication:
      access:
        ssh: true              # Allow SSH access.
        tty: false             # Allow TTY (local console) login.
      password_auth:
        ssh: false             # Allow SSH password login.
        tty: false             # Allow TTY (local console) password login.
      2fa:
        ssh: false             # Require 2FA for SSH access.
        tty: false             # Require 2FA for TTY (local console) login.
    privileges:
      description: "Automation user without interactive shell and no sudo."
      sudo: true               # Whether the user can escalate to root using sudo.
      system_user: true        # Whether this is a low-UID system user (e.g., for automation).
      restricted: true         # If true, user is limited in scope (e.g., no login, no file access).
      shell_access: false      # MUST be "true" if shell is not '/usr/sbin/nologin' or '/bin/false'.

# vim: number et ts=2 sw=2 sts=2 ai tw=128 ft=yaml
