---
################################################################################
# Global variables
################################################################################
# Variables assigned based on environment variables
venom_dir: /usr/local/pf/t/venom
test_suites_dir: '{{.venom_dir}}/test_suites'
test_suite_results_dir: '{{.venom_dir}}/results'
switch_test_suite_dir: '{{.venom_dir}}/switches'
nodes_test_suite_dir: '{{.test_suites_dir}}/nodes'

# ssh executor variables
ssh_user: vagrant

# pfserver variables
pfserver_webadmin_url: 'https://{{.pfserver_mgmt_ip}}:1443'
pfserver_default_admin_user: admin
pfserver_default_system_user: system
pfserver_admin_password: secret
pfserver_root_dir: /usr/local/pf
pfserver_conf_dir: '{{.pfserver_root_dir}}/conf'
pfserver_bin_dir: '{{.pfserver_root_dir}}/bin'
pfserver_pfcmd: '{{.pfserver_bin_dir}}/pfcmd'
pfserver_test_dir: '{{.pfserver_root_dir}}/t'
pfserver_docker_subnet: '100.64.0.0/10'
ini_cmd: '{{.pfserver_test_dir}}/ini_cmd.pl'

# fingerbank variables
fingerbank_root_dir: '/usr/local/fingerbank/'
fingerbank_conf_dir: '{{.fingerbank_root_dir}}/conf'
fingerbank_upstream_db: '{{.fingerbank_root_dir}}/db/fingerbank_Upstream.db'
fingerbank_api_mock_pidfile: '{{.pfserver_root_dir}}/var/run/fingerbank-api-mock.pid'
fingerbank_host: '100.64.0.1'
fingerbank_port: 3003

# PacketFence general settings
pfserver_api_inactivity_timeout.interval: 12
pfserver_api_inactivity_timeout.unit: h
pfserver_pffilter_processes: 1
pfserver_pfperl_api_processes: 8
pfserver_pfqueue_workers: 8

# ad variables
ad_domain_upper: EXAMPLE
ad_dns_domain: example.lan
ad_domain_admin_user: administrator
ad_domain_admin_password: VagrantPass1
ad_base_dn: dc=example,dc=lan
ad_domain_user: packetfence

# switchs variables
switch01.api.url: "https://{{.switch01_mgmt_ip}}:8080"
switch01.api.user: cumulus
switch01.api.password: CumulusLinux!
switch01.dot1x_interface.id: swp12
switch01.dot1x_interface.node03: swp17
switch01.dot1x_interface.mac: 44:38:39:00:00:12
switch01.dot1x_interface.mac_node03: 44:38:39:00:00:17

# nodes variables
node01_hostname: node01
node01_ens7_mac_address: 00:03:00:11:11:01
node01_ens7_mac_address_url_encoded: 00%3A03%3A00%3A11%3A11%3A01

node03_hostname: node03
node03_ens7_mac_address: 00:03:00:11:13:01
node03_ens7_mac_address_url_encoded: 00%3A03%3A00%3A11%3A13%3A01

# wireless01 variables
wireless01_wlan1_mac_address: 02:00:00:00:01:00
wireless01_wlan1_mac_address_url_encoded: 02%3A00%3A00%3A00%3A01%3A00
wireless01.dot1x_interface.mac: 02:00:00:00:00:00

# network detection
network_detection_url: 'http://192.95.20.194/common/network-access-detection.gif'

# Access durations
access_duration.choices: "1h,5m,10m,3h,12h,1D,2D,3D,5D"
access_duration.default_choice: "5m"

# Access level
access_level_user_and_node.id: user_and_node_manager
access_level_user_and_node.description: Users and Nodes management

# Default VLAN id for all switches
roles.registration.vlan_id: 2
roles.isolation.vlan_id: 3

### Maintenance tasks
# Node cleanup
node_cleanup.delete_window.interval: 1
node_cleanup.delete_window.unit: m

### Network devices
# Switch group
cumulus_switch_group.id: cumulus_switch_group
cumulus_switch_group.description: Cumulus switch group
cumulus_switch_group.radiusSecret: testing123

# Switch
cumulus_switch.id1: '{{.switch01_mgmt_ip}}'
cumulus_switch.id2: '{{.switch01.dot1x_interface.mac}}'
cumulus_switch.id3: '{{.switch01.dot1x_interface.mac_node03}}'
cumulus_switch.description: switch01

# Wireless Switch group
wireless_switch_group.id: wireless_switch_group
wireless_switch_group.description: Wireless switch group
wireless_switch_group.radiusSecret: anHardSharedSecret

# Wireless Switch
wireless_switch.id1: '{{.wireless01_mgmt_ip}}'
wireless_switch.id2: '{{.wireless01.dot1x_interface.mac}}'
wireless_switch.description: wireless01

# Tinyproxy on linux02
linux02.tinyproxy.port: "8888"

################################################################################
# eap_peap test suites specific variables
################################################################################
# AD user
eap_peap.roles.ad_user.id: user_employee
eap_peap.roles.ad_user.notes: User employee
eap_peap.roles.ad_user.vlan_id: 100

eap_peap.roles.ad_machine.id: machine_employee
eap_peap.roles.ad_machine.notes: Machine Employee
eap_peap.roles.ad_machine.vlan_id: 100

################################################################################
# dot1x_eap_peap test suite specific variables
################################################################################
# Roles
dot1x_eap_peap.roles.ad_user.id: '{{.eap_peap.roles.ad_user.id}}'
dot1x_eap_peap.roles.ad_user.notes: '{{.eap_peap.roles.ad_user.notes}}'
dot1x_eap_peap.roles.ad_user.vlan_id: '{{.eap_peap.roles.ad_user.vlan_id}}'

dot1x_eap_peap.roles.ad_machine.id: '{{.eap_peap.roles.ad_machine.id}}'
dot1x_eap_peap.roles.ad_machine.notes: '{{.eap_peap.roles.ad_machine.notes}}'
dot1x_eap_peap.roles.ad_machine.vlan_id: '{{.eap_peap.roles.ad_machine.vlan_id}}'

# Sources
dot1x_eap_peap.sources.ad_user.name: dot1x_eap_peap_user_auth
dot1x_eap_peap.sources.ad_user.description: '{{.ad_mgmt_ip}} user authentication'
dot1x_eap_peap.sources.ad_user.access_duration: '{{.access_duration.default_choice}}'

dot1x_eap_peap.sources.ad_machine.name: dot1x_eap_peap_machine_auth
dot1x_eap_peap.sources.ad_machine.description: '{{.ad_mgmt_ip}} machine authentication'
dot1x_eap_peap.sources.ad_machine.access_duration: '{{.access_duration.default_choice}}'

# Connection profiles
dot1x_eap_peap.profiles.wired.id: catch_dot1x_wired_eap_peap_mschapv2
dot1x_eap_peap.profiles.wired.description: 802.1X wired EAP-PEAP-MSCHAPv2
dot1x_eap_peap.profiles.wired.filters.connection_type: Ethernet-EAP
dot1x_eap_peap.profiles.wired.filters.connection_sub_type: MS-EAP-Authentication
dot1x_eap_peap.profiles.wired.unreg_on_acct_stop: enabled

################################################################################
# wireless_dot1x_eap_peap test suite specific variables
################################################################################
# Roles
wireless_dot1x_eap_peap.roles.ad_user.id: '{{.eap_peap.roles.ad_user.id}}'
wireless_dot1x_eap_peap.roles.ad_user.notes: '{{.eap_peap.roles.ad_user.notes}}'
wireless_dot1x_eap_peap.roles.ad_user.vlan_id: '{{.eap_peap.roles.ad_user.vlan_id}}'

wireless_dot1x_eap_peap.roles.ad_machine.id: '{{.eap_peap.roles.ad_machine.id}}'
wireless_dot1x_eap_peap.roles.ad_machine.notes: '{{.eap_peap.roles.ad_machine.notes}}'
wireless_dot1x_eap_peap.roles.ad_machine.vlan_id: '{{.eap_peap.roles.ad_machine.vlan_id}}'

# Sources
wireless_dot1x_eap_peap.sources.ad_user.name: wireless_dot1x_eap_peap_user_auth
wireless_dot1x_eap_peap.sources.ad_user.description: '{{.ad_mgmt_ip}} user authentication'
wireless_dot1x_eap_peap.sources.ad_user.access_duration: '{{.access_duration.default_choice}}'

wireless_dot1x_eap_peap.sources.ad_machine.name: wireless_dot1x_eap_peap_machine_auth
wireless_dot1x_eap_peap.sources.ad_machine.description: '{{.ad_mgmt_ip}} machine authentication'
wireless_dot1x_eap_peap.sources.ad_machine.access_duration: '{{.access_duration.default_choice}}'

# Connection profiles
wireless_dot1x_eap_peap.profiles.wireless.id: catch_dot1x_wireless_eap_peap_mschapv2
wireless_dot1x_eap_peap.profiles.wireless.description: 802.1X wireless EAP-PEAP-MSCHAPv2
wireless_dot1x_eap_peap.profiles.wireless.filters.connection_type: Wireless-802.11-EAP
wireless_dot1x_eap_peap.profiles.wireless.filters.connection_sub_type: MS-EAP-Authentication
wireless_dot1x_eap_peap.profiles.wireless.unreg_on_acct_stop: enabled

################################################################################
## backup db and restore test suite specific variables
#################################################################################
# Create user for db
backup_db_and_restore.user: adminvenom
backup_db_and_restore.backup_dir: /root/backup

################################################################################
## mac auth test suites specific variables
#################################################################################
mac_auth.roles.headless_device.id: headless_device
mac_auth.roles.headless_device.notes: Headless device
mac_auth.roles.headless_device.vlan_id: 100

################################################################################
## wired_mac_auth test suite specific variables
#################################################################################
# Roles
wired_mac_auth.roles.headless_device.id: '{{.mac_auth.roles.headless_device.id}}'
wired_mac_auth.roles.headless_device.notes: '{{.mac_auth.roles.headless_device.notes}}'
wired_mac_auth.roles.headless_device.vlan_id: '{{.mac_auth.roles.headless_device.vlan_id}}'

# Connection profiles
wired_mac_auth.profiles.wired.id: catch_wired_mac_authentication
wired_mac_auth.profiles.wired.description: Wired Mac authentication
wired_mac_auth.profiles.wired.filters.connection_type: Ethernet-NoEAP
wired_mac_auth.profiles.wired.unreg_on_acct_stop: disabled

################################################################################
## wireless_mac_auth test suite specific variables
#################################################################################
# Roles
wireless_mac_auth.roles.headless_device.id: '{{.mac_auth.roles.headless_device.id}}'
wireless_mac_auth.roles.headless_device.notes: '{{.mac_auth.roles.headless_device.notes}}'
wireless_mac_auth.roles.headless_device.vlan_id: '{{.mac_auth.roles.headless_device.vlan_id}}'

# Connection profiles
wireless_mac_auth.profiles.wireless.id: catch_wireless_mac_authentication
wireless_mac_auth.profiles.wireless.description: Wireless Mac authentication
wireless_mac_auth.profiles.wireless.filters.connection_type: Wireless-802.11-NoEAP
wireless_mac_auth.profiles.wireless.unreg_on_acct_stop: disabled

################################################################################
# configurator test suite specific variables
################################################################################
### Step 1
# Interface dhcp-listener
configurator.interfaces.dhcp_listener.index: 2
configurator.interfaces.dhcp_listener.ip: '{{.internet_int_ip}}'
configurator.interfaces.dhcp_listener.netmask: '{{.internet_int_netmask}}'

# Interface mgmt
configurator.interfaces.mgmt.index: 3
configurator.interfaces.mgmt.ip: '{{.pfserver_mgmt_ip}}'
configurator.interfaces.mgmt.netmask: '{{.pfserver_mgmt_netmask}}'

# Interface registration
configurator.interfaces.reg.index: 4
configurator.interfaces.reg.dhcpd_enabled: enabled

# Interface isolation
configurator.interfaces.iso.index: 5
configurator.interfaces.iso.dhcpd_enabled: enabled

# Interface inline
configurator.interfaces.inline.index: 6

# DNS servers
configurator.dns.primary_ip: 8.8.8.8
configurator.dns.secondary_ip: '{{.ad_mgmt_ip}}'

### Step 2
# Database
configurator.db.users.root.id: root
configurator.db.users.root.password: ebjiatKeygId
configurator.db.users.pf.id: pf
configurator.db.users.pf.password: AkuddIgTatzu
configurator.db.name: pf

# Alerting
configurator.email: 'mailhog@{{.ad_dns_domain}}'
configurator.from_email: 'packetfence@{{.ad_dns_domain}}'
configurator.smtp.server: '{{.smtp_server}}'
configurator.smtp.port: '{{.smtp_port}}'

# General
configurator.domain: '{{.ad_dns_domain}}'
configurator.hostname: pf
configurator.timezone: '{{.timezone}}'

# Admin account
configurator.admin.password: '{{.pfserver_admin_password}}'

### Step 3
# Fingerbank
configurator.fingerbank_api_key.secret_id: '{{.fingerbank_api_key.secret_id}}'

################################################################################
# configurator_inline_l2 test suite specific variables
################################################################################
configurator_inline_l2.interfaces.inline.index: '{{.configurator.interfaces.inline.index }}'
configurator_inline_l2.interfaces.inline.dhcpd_enabled: enabled
configurator_inline_l2.dns.primary_ip: 8.8.8.8
configurator_inline_l2.dns.secondary_ip: '{{.ad_mgmt_ip}}'

################################################################################
# captive_portal test suite specific variables
################################################################################
# Connection profiles
captive_portal.profiles.id: catch_wired_mac_authentication
captive_portal.profiles.description: Wired Mac authentication with specific locales
captive_portal.profiles.filters.connection_type: Ethernet-NoEAP
captive_portal.profiles.locales1: fr_FR
captive_portal.profiles.locales2: en_US
captive_portal.profiles.locales3: de_DE
captive_portal.profiles.locales4: it_IT

# URL
captive_portal.reg.url: 'https://{{.configurator.hostname}}.{{.configurator.domain}}/captive-portal'

################################################################################
# wired_dot1x_eap_tls_manual test suite specific variables
################################################################################
### General settings for certs
wired_dot1x_eap_tls_manual.certs.validity: 750
wired_dot1x_eap_tls_manual.certs.key_size: 2048
wired_dot1x_eap_tls_manual.certs.key_type: 1
wired_dot1x_eap_tls_manual.certs.digest: 4
wired_dot1x_eap_tls_manual.certs.country: CA
wired_dot1x_eap_tls_manual.certs.state: Quebec
wired_dot1x_eap_tls_manual.certs.locality: Montreal
wired_dot1x_eap_tls_manual.certs.organisation: Inverse
wired_dot1x_eap_tls_manual.certs.organisational_unit: PacketFence
wired_dot1x_eap_tls_manual.certs.ocsp_url: 'https://127.0.0.1:22225/api/v1/pki/ocsp'

# CA
wired_dot1x_eap_tls_manual.certs.ca.cn: InverseCA1
wired_dot1x_eap_tls_manual.certs.ca.mail: '{{.configurator.email}}'

wired_dot1x_eap_tls_manual.certs.ca.issuer: "/C={{.wired_dot1x_eap_tls_manual.certs.country}}/ST={{.wired_dot1x_eap_tls_manual.certs.state}}/L={{.wired_dot1x_eap_tls_manual.certs.locality}}/O={{.wired_dot1x_eap_tls_manual.certs.organisation}}/OU={{.wired_dot1x_eap_tls_manual.certs.organisational_unit}}/CN={{.wired_dot1x_eap_tls_manual.certs.ca.cn}}"

### Templates
wired_dot1x_eap_tls_manual.templates.radius.name: '{{.wired_dot1x_eap_tls_manual.certs.ca.cn}}_radius'
wired_dot1x_eap_tls_manual.templates.http.name: '{{.wired_dot1x_eap_tls_manual.certs.ca.cn}}_http'
wired_dot1x_eap_tls_manual.templates.user.name: '{{.wired_dot1x_eap_tls_manual.certs.ca.cn}}_user'

# RADIUS cert
wired_dot1x_eap_tls_manual.certs.radius.cn: '{{.wired_dot1x_eap_tls_manual.templates.radius.name}}_cert'
wired_dot1x_eap_tls_manual.certs.radius.mail: '{{.configurator.email}}'
wired_dot1x_eap_tls_manual.certs.radius.dns_names: '{{.configurator.hostname}}.{{.configurator.domain}}'
wired_dot1x_eap_tls_manual.certs.radius.ip_addresses: '{{.configurator.interfaces.mgmt.ip}}'

# HTTP cert
wired_dot1x_eap_tls_manual.certs.http.cn: '{{.wired_dot1x_eap_tls_manual.templates.http.name}}_cert'
wired_dot1x_eap_tls_manual.certs.http.mail: '{{.configurator.email}}'
wired_dot1x_eap_tls_manual.certs.http.dns_names: '{{.configurator.hostname}}.{{.configurator.domain}},packetfence.example.lan'
wired_dot1x_eap_tls_manual.certs.http.ip_addresses: '{{.configurator.interfaces.mgmt.ip}},66.70.255.147,{{.configurator.interfaces.reg.ip}},{{.configurator.interfaces.iso.ip}}'

# User cert
wired_dot1x_eap_tls_manual.certs.user.cn: '{{.wired_dot1x_eap_tls_manual.templates.user.name}}_cert'
wired_dot1x_eap_tls_manual.certs.user.mail: '{{.configurator.email}}'
wired_dot1x_eap_tls_manual.certs.user.scep_enabled: 1
wired_dot1x_eap_tls_manual.certs.user.scep_challenge_password: secret
wired_dot1x_eap_tls_manual.certs.user.scep_days_before_renewal: 0
  #wired_dot1x_eap_tls_manual.certs.user.subject: "/C={{.wired_dot1x_eap_tls_manual.certs.country}}/ST={{.wired_dot1x_eap_tls_manual.certs.state}}/L={{.wired_dot1x_eap_tls_manual.certs.locality}}/O={{.wired_dot1x_eap_tls_manual.certs.organisation}}/OU={{.wired_dot1x_eap_tls_manual.certs.organisational_unit}}/CN={{.wired_dot1x_eap_tls_manual.certs.user.cn}}"
wired_dot1x_eap_tls_manual.certs.user.subject: "/CN={{.wired_dot1x_eap_tls_manual.certs.user.cn}}"

# OCSP config
wired_dot1x_eap_tls_manual.ocsp.id: ocsp_from_cert
wired_dot1x_eap_tls_manual.ocsp.enable: yes
wired_dot1x_eap_tls_manual.ocsp.url: ""
wired_dot1x_eap_tls_manual.ocsp.override_cert_url: no
wired_dot1x_eap_tls_manual.ocsp.softfail: no
wired_dot1x_eap_tls_manual.ocsp.timeout: 0
wired_dot1x_eap_tls_manual.ocsp.use_nonce: yes

# Roles
wired_dot1x_eap_tls_manual.roles.dot1x_eap_tls.id: dot1x_eap_tls_manual
wired_dot1x_eap_tls_manual.roles.dot1x_eap_tls.notes: 802.1x role for PacketFence PKI
wired_dot1x_eap_tls_manual.roles.dot1x_eap_tls.vlan_id: 100

# Sources
wired_dot1x_eap_tls_manual.sources.eaptls.name: 'eaptls'
wired_dot1x_eap_tls_manual.sources.eaptls.description: 'EAP-TLS source'
wired_dot1x_eap_tls_manual.sources.eaptls.access_duration: '{{.access_duration.default_choice}}'

# Connection profiles
wired_dot1x_eap_tls_manual.profiles.wired.id: catch_dot1x_wired_eap_tls
wired_dot1x_eap_tls_manual.profiles.wired.description: 802.1X wired EAP-TLS
wired_dot1x_eap_tls_manual.profiles.wired.filters.connection_type: Ethernet-EAP
wired_dot1x_eap_tls_manual.profiles.wired.filters.connection_sub_type: EAP-TLS
wired_dot1x_eap_tls_manual.profiles.wired.unreg_on_acct_stop: enabled

# Path to client certificates
wired_dot1x_eap_tls_manual.paths.clients_directory: /root/client_certificates
wired_dot1x_eap_tls_manual.paths.per_client_directory: '{{.wired_dot1x_eap_tls_manual.paths.clients_directory}}/{{.wired_dot1x_eap_tls_manual.certs.user.cn}}'

################################################################################
# wired_dot1x_eap_tls_scep test suite specific variables
################################################################################
### General settings for certs
wired_dot1x_eap_tls_scep.certs.validity: 750
wired_dot1x_eap_tls_scep.certs.key_size: 2048
wired_dot1x_eap_tls_scep.certs.key_type: 1
wired_dot1x_eap_tls_scep.certs.digest.number: 4
wired_dot1x_eap_tls_scep.certs.digest.text: sha256WithRSAEncryption
wired_dot1x_eap_tls_scep.certs.country: CA
wired_dot1x_eap_tls_scep.certs.state: Quebec
wired_dot1x_eap_tls_scep.certs.locality: Montreal
wired_dot1x_eap_tls_scep.certs.organisation: Inverse
wired_dot1x_eap_tls_scep.certs.organisational_unit: PacketFence
wired_dot1x_eap_tls_scep.certs.ocsp_url: 'https://127.0.0.1:22225/api/v1/pki/ocsp'

# CA
wired_dot1x_eap_tls_scep.certs.ca.cn: InverseCA2
wired_dot1x_eap_tls_scep.certs.ca.mail: '{{.configurator.email}}'

wired_dot1x_eap_tls_scep.certs.ca.issuer: "/C={{.wired_dot1x_eap_tls_scep.certs.country}}/ST={{.wired_dot1x_eap_tls_scep.certs.state}}/L={{.wired_dot1x_eap_tls_scep.certs.locality}}/O={{.wired_dot1x_eap_tls_scep.certs.organisation}}/OU={{.wired_dot1x_eap_tls_scep.certs.organisational_unit}}/CN={{.wired_dot1x_eap_tls_scep.certs.ca.cn}}"

### Templates
wired_dot1x_eap_tls_scep.templates.radius.name: '{{.wired_dot1x_eap_tls_scep.certs.ca.cn}}_radius'
wired_dot1x_eap_tls_scep.templates.http.name: '{{.wired_dot1x_eap_tls_scep.certs.ca.cn}}_http'
wired_dot1x_eap_tls_scep.templates.user.name: '{{.wired_dot1x_eap_tls_scep.certs.ca.cn}}_user'

# RADIUS cert
wired_dot1x_eap_tls_scep.certs.radius.cn: '{{.wired_dot1x_eap_tls_scep.templates.radius.name}}_cert'
wired_dot1x_eap_tls_scep.certs.radius.mail: '{{.configurator.email}}'
wired_dot1x_eap_tls_scep.certs.radius.dns_names: '{{.configurator.hostname}}.{{.configurator.domain}}'
wired_dot1x_eap_tls_scep.certs.radius.ip_addresses: '{{.configurator.interfaces.mgmt.ip}}'

# HTTP cert
wired_dot1x_eap_tls_scep.certs.http.cn: '{{.wired_dot1x_eap_tls_scep.templates.http.name}}_cert'
wired_dot1x_eap_tls_scep.certs.http.mail: '{{.configurator.email}}'
wired_dot1x_eap_tls_scep.certs.http.dns_names: '{{.configurator.hostname}}.{{.configurator.domain}},packetfence.example.lan'
wired_dot1x_eap_tls_scep.certs.http.ip_addresses: '{{.configurator.interfaces.mgmt.ip}},66.70.255.147,{{.configurator.interfaces.reg.ip}},{{.configurator.interfaces.iso.ip}}'

# User cert
wired_dot1x_eap_tls_scep.certs.user.cn: '{{.wired_dot1x_eap_tls_scep.templates.user.name}}_cert'
wired_dot1x_eap_tls_scep.certs.user.extended_key_usage.number: 2
wired_dot1x_eap_tls_scep.certs.user.extended_key_usage.text: TLS Web Client Authentication
wired_dot1x_eap_tls_scep.certs.user.dns1: '{{.node01_hostname}}'
wired_dot1x_eap_tls_scep.certs.user.email: '{{.node01_hostname}}@{{.configurator.domain}}'
wired_dot1x_eap_tls_scep.certs.user.other_name: '{{.node01_hostname}}-alias@{{.configurator.domain}}'
wired_dot1x_eap_tls_scep.certs.user.scep_enabled: 1
wired_dot1x_eap_tls_scep.certs.user.scep_challenge_password: secret
wired_dot1x_eap_tls_scep.certs.user.scep_days_before_renewal: 7
wired_dot1x_eap_tls_scep.certs.user.subject: "/C={{.wired_dot1x_eap_tls_scep.certs.country}}/ST={{.wired_dot1x_eap_tls_scep.certs.state}}/L={{.wired_dot1x_eap_tls_scep.certs.locality}}/O={{.wired_dot1x_eap_tls_scep.certs.organisation}}/OU={{.wired_dot1x_eap_tls_scep.certs.organisational_unit}}/CN={{.wired_dot1x_eap_tls_scep.certs.user.cn}}"

wired_dot1x_eap_tls_scep.certs.user.subject_openssl: "C = {{.wired_dot1x_eap_tls_scep.certs.country}}, ST = {{.wired_dot1x_eap_tls_scep.certs.state}}, L = {{.wired_dot1x_eap_tls_scep.certs.locality}}, O = {{.wired_dot1x_eap_tls_scep.certs.organisation}}, OU = {{.wired_dot1x_eap_tls_scep.certs.organisational_unit}}, CN = {{.wired_dot1x_eap_tls_scep.certs.user.cn}}"

# OCSP config
wired_dot1x_eap_tls_scep.ocsp.id: ocsp_from_cert
wired_dot1x_eap_tls_scep.ocsp.enable: yes
wired_dot1x_eap_tls_scep.ocsp.url: ""
wired_dot1x_eap_tls_scep.ocsp.override_cert_url: no
wired_dot1x_eap_tls_scep.ocsp.softfail: no
wired_dot1x_eap_tls_scep.ocsp.timeout: 0
wired_dot1x_eap_tls_scep.ocsp.use_nonce: yes

# Roles
wired_dot1x_eap_tls_scep.roles.dot1x_eap_tls.id: dot1x_eap_tls_scep
wired_dot1x_eap_tls_scep.roles.dot1x_eap_tls.notes: 802.1x role for PacketFence PKI
wired_dot1x_eap_tls_scep.roles.dot1x_eap_tls.vlan_id: 100

# Sources
wired_dot1x_eap_tls_scep.sources.eaptls.name: 'eaptls'
wired_dot1x_eap_tls_scep.sources.eaptls.description: 'EAP-TLS source'
wired_dot1x_eap_tls_scep.sources.eaptls.access_duration: '{{.access_duration.default_choice}}'

# Connection profiles
wired_dot1x_eap_tls_scep.profiles.wired.id: catch_dot1x_wired_eap_tls
wired_dot1x_eap_tls_scep.profiles.wired.description: 802.1X wired EAP-TLS
wired_dot1x_eap_tls_scep.profiles.wired.filters.connection_type: Ethernet-EAP
wired_dot1x_eap_tls_scep.profiles.wired.filters.connection_sub_type: EAP-TLS
wired_dot1x_eap_tls_scep.profiles.wired.unreg_on_acct_stop: enabled

################################################################################
# wired_dot1x_eap_tls_pki test suite specific variables
################################################################################
### General settings for certs
wired_dot1x_eap_tls_pki.certs.validity: 750
wired_dot1x_eap_tls_pki.certs.key_size: 2048
wired_dot1x_eap_tls_pki.certs.key_type: 1
wired_dot1x_eap_tls_pki.certs.digest.number: 4
wired_dot1x_eap_tls_pki.certs.digest.text: sha256WithRSAEncryption
wired_dot1x_eap_tls_pki.certs.country: CA
wired_dot1x_eap_tls_pki.certs.state: Quebec
wired_dot1x_eap_tls_pki.certs.locality: Montreal
wired_dot1x_eap_tls_pki.certs.organisation: Inverse
wired_dot1x_eap_tls_pki.certs.organisational_unit: PacketFence
wired_dot1x_eap_tls_pki.certs.ocsp_url: 'https://127.0.0.1:22225/api/v1/pki/ocsp'

# CA
wired_dot1x_eap_tls_pki.certs.ca.cn: InverseCA3
wired_dot1x_eap_tls_pki.certs.ca.mail: '{{.configurator.email}}'

wired_dot1x_eap_tls_pki.certs.ca.issuer: "/C={{.wired_dot1x_eap_tls_pki.certs.country}}/ST={{.wired_dot1x_eap_tls_pki.certs.state}}/L={{.wired_dot1x_eap_tls_pki.certs.locality}}/O={{.wired_dot1x_eap_tls_pki.certs.organisation}}/OU={{.wired_dot1x_eap_tls_pki.certs.organisational_unit}}/CN={{.wired_dot1x_eap_tls_pki.certs.ca.cn}}"

### Templates
wired_dot1x_eap_tls_pki.templates.radius.name: '{{.wired_dot1x_eap_tls_pki.certs.ca.cn}}_radius'
wired_dot1x_eap_tls_pki.templates.http.name: '{{.wired_dot1x_eap_tls_pki.certs.ca.cn}}_http'
wired_dot1x_eap_tls_pki.templates.user.name: '{{.wired_dot1x_eap_tls_pki.certs.ca.cn}}_user'

# RADIUS cert
wired_dot1x_eap_tls_pki.certs.radius.cn: '{{.wired_dot1x_eap_tls_pki.templates.radius.name}}_cert'
wired_dot1x_eap_tls_pki.certs.radius.mail: '{{.configurator.email}}'
wired_dot1x_eap_tls_pki.certs.radius.dns_names: '{{.configurator.hostname}}.{{.configurator.domain}}'
wired_dot1x_eap_tls_pki.certs.radius.ip_addresses: '{{.configurator.interfaces.mgmt.ip}}'

# HTTP cert
wired_dot1x_eap_tls_pki.certs.http.cn: '{{.wired_dot1x_eap_tls_pki.templates.http.name}}_cert'
wired_dot1x_eap_tls_pki.certs.http.mail: '{{.configurator.email}}'
wired_dot1x_eap_tls_pki.certs.http.dns_names: '{{.configurator.hostname}}.{{.configurator.domain}},packetfence.example.lan'
wired_dot1x_eap_tls_pki.certs.http.ip_addresses: '{{.configurator.interfaces.mgmt.ip}},66.70.255.147,{{.configurator.interfaces.reg.ip}},{{.configurator.interfaces.iso.ip}}'

# User cert
wired_dot1x_eap_tls_pki.certs.user.cn: '{{.wired_dot1x_eap_tls_pki.templates.user.name}}_cert'
wired_dot1x_eap_tls_pki.certs.user.extended_key_usage.number: 2
wired_dot1x_eap_tls_pki.certs.user.extended_key_usage.text: TLS Web Client Authentication
wired_dot1x_eap_tls_pki.certs.user.dns1: '{{.node01_hostname}}'
wired_dot1x_eap_tls_pki.certs.user.mail: '{{.configurator.email}}'
wired_dot1x_eap_tls_pki.certs.user.email: '{{.node01_hostname}}@{{.configurator.domain}}'
wired_dot1x_eap_tls_pki.certs.user.other_name: '{{.node01_hostname}}-alias@{{.configurator.domain}}'
wired_dot1x_eap_tls_pki.certs.user.scep_enabled: 0
wired_dot1x_eap_tls_pki.certs.user.scep_challenge_password: secret
wired_dot1x_eap_tls_pki.certs.user.scep_days_before_renewal: 7
wired_dot1x_eap_tls_pki.certs.user.subject: "/C={{.wired_dot1x_eap_tls_pki.certs.country}}/ST={{.wired_dot1x_eap_tls_pki.certs.state}}/L={{.wired_dot1x_eap_tls_pki.certs.locality}}/O={{.wired_dot1x_eap_tls_pki.certs.organisation}}/OU={{.wired_dot1x_eap_tls_pki.certs.organisational_unit}}/CN={{.wired_dot1x_eap_tls_pki.certs.user.cn}}"
wired_dot1x_eap_tls_pki.certs.user.subject_openssl: "C = {{.wired_dot1x_eap_tls_pki.certs.country}}, ST = {{.wired_dot1x_eap_tls_pki.certs.state}}, L = {{.wired_dot1x_eap_tls_pki.certs.locality}}, O = {{.wired_dot1x_eap_tls_pki.certs.organisation}}, OU = {{.wired_dot1x_eap_tls_pki.certs.organisational_unit}}, CN = {{.wired_dot1x_eap_tls_pki.certs.user.cn}}"

# OCSP config
wired_dot1x_eap_tls_pki.ocsp.id: ocsp_from_cert
wired_dot1x_eap_tls_pki.ocsp.enable: yes
wired_dot1x_eap_tls_pki.ocsp.url: ""
wired_dot1x_eap_tls_pki.ocsp.override_cert_url: no
wired_dot1x_eap_tls_pki.ocsp.softfail: no
wired_dot1x_eap_tls_pki.ocsp.timeout: 0
wired_dot1x_eap_tls_pki.ocsp.use_nonce: yes

# Roles
wired_dot1x_eap_tls_pki.roles.ad_user.id: '{{.eap_peap.roles.ad_user.id}}'
wired_dot1x_eap_tls_pki.roles.ad_user.notes: '{{.eap_peap.roles.ad_user.notes}}'
wired_dot1x_eap_tls_pki.roles.ad_user.vlan_id: '{{.eap_peap.roles.ad_user.vlan_id}}'

wired_dot1x_eap_tls_pki.roles.ad_machine.id: '{{.eap_peap.roles.ad_machine.id}}'
wired_dot1x_eap_tls_pki.roles.ad_machine.notes: '{{.eap_peap.roles.ad_machine.notes}}'
wired_dot1x_eap_tls_pki.roles.ad_machine.vlan_id: '{{.eap_peap.roles.ad_machine.vlan_id}}'

# Sources
wired_dot1x_eap_tls_pki.sources.ad_user.name: wired_dot1x_eap_tls_pki_user_auth
wired_dot1x_eap_tls_pki.sources.ad_user.description: '{{.ad_mgmt_ip}} user authentication'
wired_dot1x_eap_tls_pki.sources.ad_user.access_duration: '{{.access_duration.default_choice}}'

wired_dot1x_eap_tls_pki.sources.ad_machine.name: wired_dot1x_eap_tls_pki_machine_auth
wired_dot1x_eap_tls_pki.sources.ad_machine.description: '{{.ad_mgmt_ip}} machine authentication'
wired_dot1x_eap_tls_pki.sources.ad_machine.access_duration: '{{.access_duration.default_choice}}'

# Connection profiles
wired_dot1x_eap_tls_pki.profiles.wired.id: catch_dot1x_wired_eap_tls
wired_dot1x_eap_tls_pki.profiles.wired.description: 802.1X wired EAP-TLS
wired_dot1x_eap_tls_pki.profiles.wired.filters.connection_type: Ethernet-EAP
wired_dot1x_eap_tls_pki.profiles.wired.filters.connection_sub_type: EAP-TLS
wired_dot1x_eap_tls_pki.profiles.wired.unreg_on_acct_stop: enabled

# Path to client certificates
wired_dot1x_eap_tls_pki.paths.clients_directory: /root/client_certificates
wired_dot1x_eap_tls_pki.paths.per_client_directory: '{{.wired_dot1x_eap_tls_pki.paths.clients_directory}}/{{.wired_dot1x_eap_tls_pki.certs.user.cn}}'

################################################################################
# fingerbank_proxy test suite specific variables
################################################################################
fingerbank_proxy_test_wan_ip: 1.1.1.1

################################################################################
#Cli Radius test test suite specific variables
#################################################################################
cli_login_radius.sources.id: cli_login_radius_source
cli_login_radius.sources.radius_machine.id:
cli_login_radius.sources.access_duration: 5D
cli_login_radius.sources.desc: "Test for radius cli"
cli_login_radius.sources.host: "127.0.0.1"
cli_login_radius.sources.port: 1820
cli_login_radius.sources.realms: ""
cli_login_radius.sources.secret: testing123
cli_login_radius.sources.role: default
cli_login_radius.realm.id: cli_login_radius_realm_id
cli_login_radius.realm.domain: example
cli_login_radius.pod: "/usr/local/pf/pod.txt"
cli_login_radius.pod_proxy: "/usr/local/pf/pod_proxy.txt"
cli_login_radius.switch.ip: 192.168.0.1

################################################################################
## Inline test suite specific variables
#################################################################################
#
# WARNING some variables are hard coded in golang executor
# like the user (iastigmate) and password in the /root/register_node
#
inline_lx_iastigmate.password.expiration: "2031-12-01 00:00:00"
inline_lx.pf_portal_url: "https://pf.example.lan"
inline_l3.node.macaddress: 02:06:19:98:00:00
inline_l3.node.ipaddress: 192.168.1.10
inline_l3.pf_portal: 192.168.1.1
inline_l3.routed_networks: 192.168.1.0
inline_l2.node.macaddress: 02:06:19:98:00:01
inline_l2.node.ipaddress: 192.168.2.10
inline_l2.pf_portal: 192.168.2.1
inline_l2.networks: 192.168.2.0

################################################################################
## Security event autoreg test suite specific variables
#################################################################################
security_event_autoreg.event.id: '88888888'
security_event_autoreg.event.access_duration: '5D'
security_event_autoreg.event.desc: 'Test DHCP autoreg venom'
security_event_autoreg.node.mac: '{{.node01_ens7_mac_address}}'
security_event_autoreg.node.mac_url_encoded: '{{.node01_ens7_mac_address_url_encoded}}'
security_event_autoreg.node.dhcp_fingerprint: 1,28,2,3,15,6,119,12,44,47,26,121,42
security_event_autoreg.node.dhcp_fingerprint_id: 276

################################################################################
## Security event suricata test suite specific variables
#################################################################################
security_event_suricata.event.id: '88888889'
security_event_suricata.event_handler.id: 'Suricata'
security_event_suricata.event.access_duration: '12h'
security_event_suricata.event.desc: 'ET P2P Kaaza Media'
security_event_suricata.fifo_file: '/usr/local/pf/var/suricata'
security_event_suricata.node.macaddress: 02:06:19:98:00:02
security_event_suricata.node.ipaddress: 192.168.3.10
security_event_suricata.pf_portal: 192.168.3.1
security_event_suricata.networks: 192.168.3.0

################################################################################
## Security event random_mac test suite specific variables
#################################################################################
security_event_random_mac.event.id: '3000007'
security_event_random_mac.node.macaddress: 02:06:19:98:00:04
security_event_random_mac.node.ipaddress: 192.168.4.10
security_event_random_mac.pf_portal: 192.168.4.1
security_event_random_mac.networks: 192.168.4.0

#################################################################################
## inline_l2_and_radius test suite specific variables
#################################################################################

# network and interfaces
inline_l2_and_radius.l2_network.nat: enabled
inline_l2_and_radius.l2_network.registration: 10.0.1.0/8
inline_l2_and_radius.l2_network.split: enabled
inline_l2_and_radius.l2_network.coa: enabled
inline_l2_and_radius.l2_network.netflow: enabled
inline_l2_and_radius.l2_network.lease_time: 30

# roles
inline_l2_and_radius.roles.first: role_01
inline_l2_and_radius.roles.second: role_02

# profiles
inline_l2_and_radius.profiles.id: catch_wired_mac_authentication
inline_l2_and_radius.profiles.description: Wired Mac authentication
inline_l2_and_radius.profiles.filters.connection_type: Ethernet-NoEAP
inline_l2_and_radius.profiles.unreg_on_acct_stop: disabled

################################################################################
## firewall_sso test suite specific variables
#################################################################################
# HTTPS Firewall SSO
firewall_sso.https.host: '{{.pfserver_mgmt_ip}}'
firewall_sso.https.port_config: 8180
firewall_sso.https.port_http: 8181
firewall_sso.https.port_https: 8182
firewall_sso.https.transport: http
firewall_sso.https.password: secret
firewall_sso.https.type: PaloAlto

# HTTPS Firewall SSO Mock - Smocker
smocker_dir: /opt/smocker

# RADIUS Firewall SSO
firewall_sso.radius.api_host: '{{.pfserver_mgmt_ip}}'
firewall_sso.radius.api_port: 8183
firewall_sso.radius.radius_host: '{{.pfserver_mgmt_ip}}'
firewall_sso.radius.radius_port: 8184
firewall_sso.radius.radius_secret: secret
firewall_sso.radius.radius_user_name: foo
firewall_sso.radius.radius_user_password: bar
firewall_sso.radius.radius_mock_dir: '{{.pfserver_root_dir}}/t/mock_servers/node_radius'
firewall_sso.radius.type: FortiGate

#################################################################################
## html e2e tests
#################################################################################
html.pfappserver_baseurl: 'https://{{.pfserver_mgmt_ip}}:1443'
html.pfappserver_dir: '{{.pfserver_root_dir}}/t/html/pfappserver'
