fixed some security

ansible/preparing-playbook/reza-ansible/inventory/group_vars/all/docker.yaml

@@ -1,10 +1,10 @@
-# http proxy
-http_proxy: http://37.59.93.12:8520
+# http proxy and registry mirror come from vault.yaml (see vault.yaml.example)
+http_proxy: "{{ vault_docker_proxy }}"
 
 # docker variables
 docker:
   http_proxy: "{{ http_proxy }}"
-  no_proxy: localhost,127.0.0.1,hub.hamdocker.ir
+  no_proxy: "localhost,127.0.0.1,{{ vault_registry_mirror_host }}"
   log_max_file: "5"
   log_max_size: 100m
-  registry_mirror: https://hub.hamdocker.ir
+  registry_mirror: "{{ vault_registry_mirror }}"

ansible/preparing-playbook/reza-ansible/inventory/group_vars/all/preparing.yaml

@@ -45,10 +45,9 @@ iptables:
     - 80
     - 443
   #udp_port_access:
-  trusted_IP:
-    - 87.247.187.145
-  trusted_Range:
-    - 10.60.10.0/24
+  # trusted IPs/ranges come from vault.yaml (see vault.yaml.example)
+  trusted_IP: "{{ vault_trusted_ips }}"
+  trusted_Range: "{{ vault_trusted_ranges }}"
 
 # fail2ban configuration
 fail2ban:

ansible/preparing-playbook/reza-ansible/inventory/group_vars/all/proxy.yaml

@@ -1,4 +1,5 @@
 # setup http proxy configuration
+# credentials/host come from vault.yaml (see vault.yaml.example) — never hardcode here
 proxy_env:
-  http_proxy: http://salam:salam@130.185.121.18:6789
+  http_proxy: "http://{{ vault_proxy_user }}:{{ vault_proxy_pass }}@{{ vault_proxy_host }}:{{ vault_proxy_port }}"
   https_proxy: "{{ http_proxy }}"

ansible/preparing-playbook/reza-ansible/inventory/group_vars/all/repo-server.yaml

@@ -9,19 +9,20 @@ TRAEFIK_IMAGE: traefik
 TRAEFIK_VERSION: v2.6.1
 
 # Domain and subdomain definition
-DOMAIN_NAME: ansible.mecan.ir
+# DOMAIN_NAME, WEB_AUTH_USER and both emails come from vault.yaml (see vault.yaml.example)
+DOMAIN_NAME: "{{ vault_domain_name }}"
 TRAEFIK_SUB_DOMAIN: web
 NEXUS_SUB_DOMAIN: repo
 HUB_SUB_DOMAIN: hub
 
 # pass generate with this commands
 # htpasswd -nbs user pass
-WEB_AUTH_USER: DockerMe
-TRAEFIK_ACME_EMAIL: ahmad@DockerMe.ir
+WEB_AUTH_USER: "{{ vault_web_auth_user }}"
+TRAEFIK_ACME_EMAIL: "{{ vault_acme_email }}"
 
 # Nexus configuration
 NEXUS_ADMIN_USERNAME: admin
 NEXUS_SERVICE_URL: "https://{{ NEXUS_SUB_DOMAIN }}.{{ DOMAIN_NAME }}"
 NEXUS_REPO_USERNAME: repo
-NEXUS_REPO_EMAIL: ahmad@DockerMe.ir
+NEXUS_REPO_EMAIL: "{{ vault_repo_email }}"
 DOCKER_REPO_BLOBSTORE: docker

ansible/preparing-playbook/reza-ansible/inventory/group_vars/all/vault.yaml.example

@@ -0,0 +1,33 @@
+# Copy the keys below into the REAL vault.yaml with real values, then encrypt:
+#   ansible-vault encrypt inventory/group_vars/all/vault.yaml --vault-password-file .vault.pass
+# To edit it later without re-encrypting by hand:
+#   ansible-vault edit inventory/group_vars/all/vault.yaml --vault-password-file .vault.pass
+#
+# This file itself is a template only — commit it, never commit the real vault.yaml
+# in plaintext.
+
+# proxy.yaml
+vault_proxy_user: changeme
+vault_proxy_pass: changeme
+vault_proxy_host: 0.0.0.0
+vault_proxy_port: 8080
+
+# docker.yaml
+vault_docker_proxy: http://0.0.0.0:8080
+vault_registry_mirror: https://your-registry-mirror.example.com
+vault_registry_mirror_host: your-registry-mirror.example.com
+
+# preparing.yaml (iptables trusted allowlist)
+vault_trusted_ips:
+  - 203.0.113.10
+vault_trusted_ranges:
+  - 203.0.113.0/24
+
+# repo-server.yaml
+vault_domain_name: example.com
+vault_web_auth_user: changeme
+vault_acme_email: you@example.com
+vault_repo_email: you@example.com
+
+# inventory/host.yaml
+vault_ssh_key_path: ~/.ssh/id_rsa