config.sops.yml

# ==================================================
# SOPS encrypted variables file
# ==================================================
# Recursively merges itself with the unencrypted
# variables in this file
# Add this flag when running the playbook:
#   -e sops_file=config.sops.yml
# ==================================================
# Role: dotfiles
# ==================================================
dotfiles_auth_home: ENC[AES256_GCM,data:MtLezr3yaZTbT+k=,iv:FXv/+78H99B3NED8ZeDEOgLlTWaM/8TWBeep02/Wuyo=,tag:KFsDBlxq17ufXLl/nkVqHg==,type:str]
dotfiles_secrets_src: ENC[AES256_GCM,data:/RyJDpnH2caeA6LZMETAE+P7yxP9pcUQPA==,iv:Mtyy8OTGHZ2XHsDJkDNSaMjoE8lInqOU4gWUBud5/6Q=,tag:W5zIma3C5tdcFfhMuVszFA==,type:str]
dotfiles_secrets:
    git:
        email: ENC[AES256_GCM,data:RS5eaz6CPlsDfm/QW4KoPNl8OfuJewYEljaMU0Tabpl83R4D8EmkeyY6Mg==,iv:mCBY0QOAr08Nm1OOvvdxtZA6aeAS4toM5C4aZnc+Kvg=,tag:xf/WOD/fRXFgkR+eajRk5A==,type:str]
        signing_key: ENC[AES256_GCM,data:8RNtWuJmPjLpA1613xIYsw==,iv:7pWIQkNodksfo22VTDVssBRJbz8XMi3ayH5SlZMI3vs=,tag:deQ5akxyk9Y1qiebybYzyA==,type:str]
dotfiles_zsh_extra_aliases:
    cdgit: ENC[AES256_GCM,data:AquENrEZVyd32kqQsqF4n5jvNudYTObi+J4CTGM=,iv:oCQ1txvh3QugWpocGn0PACemuS6fuL+7+/B9GdArqos=,tag:PwLO0/b020Nle09foIiv0g==,type:str]
    cdmega: ENC[AES256_GCM,data:52EYoDxy9S60,iv:vW7Wg95I0bA75ROMlQejaUc5SW8URzCOKQEp5D/7C10=,tag:Na2jJr7CeUN3/IDCcWeIwA==,type:str]
    rsd: ENC[AES256_GCM,data:8Nt5TAPQ/yI7GxJBFLMZb3HdJiWUaTr1P2CbagPLh/iaP/0nl8/eUl1uZ1R/p5mEZgL9kmeAT5xTy3scl/8rdK6bgKCUxViVndf576Rp+4kJ7uOWMtMmCGrCAS8OuvBSdl8rY8RGGethiHeDFTKL21sAQlIi/2ffif/bzFErFEk8/ledZKaGAWNUNtaSjdxbcI17jiibHazGwZrKkJiYfqsJOlRKP9cIB4g6n3cAcU8i95OLqxuDkqxqG7DC2s6ffBldNztsXAhjpJ7jgmwWyZtxBtiGirItw4sr04knRRmNm3wvSPBspSjlLTkdT3ErlXE=,iv:YQ8Rby1I+LfY78ghc0xjaROpWUN+Dha5ilWqd6Yyyrw=,tag:9vlsN9BbXtkb5vfpkf7+cw==,type:str]
dotfiles_exclude:
    - agents
# ==================================================
# Role: geerlingguy.mac.homebrew
#   - docs: https://github.com/geerlingguy/ansible-collection-mac/blob/master/roles/homebrew/README.md
# ==================================================
homebrew_upgrade_all_packages: true
homebrew_taps:
    - cirruslabs/cli
    - derailed/k9s
    - teamookla/speedtest
    - coderabbitai/tap
homebrew_installed_packages:
    # CLI Utilities
    - bat
    - eza
    - fzf
    - htop
    - iftop
    - jq
    - make
    - node
    - powerlevel10k
    - ripgrep
    - rsync
    - tmux
    - tree
    - watch
    - xdg-ninja
    - yq
    # Git / Version Control
    - gh
    - ghorg
    - git
    - coderabbitai/tap/git-gtr
    - gnupg
    - lazygit
    - pinentry-mac
    - sops
    # Kubernetes / Cloud / DevOps
    - ansible
    - argocd
    - cirruslabs/cli/cirrus
    - cmctl
    - cloudflared
    - cf-terraforming
    - derailed/k9s/k9s
    - age
    - helm
    - influxdb-cli
    - kind
    - kopia
    - ktop
    - kubectx
    - oci-cli
    - rclone
    - sops
    - stern
    - cirruslabs/cli/tart
    - terraform
    - velero
    - etcd
    # Network / Monitoring
    - iperf3
    - nmap
    - teamookla/speedtest/speedtest
    - telnet
    - wakeonlan
    # Media / Download tools
    - exiftool
    - ffmpeg
    - yt-dlp
homebrew_cask_apps:
    # Development / IDEs
    - arduino
    - balenaetcher
    - bruno
    - claude
    - claude-code
    - cyberduck
    - datagrip
    - docker-desktop
    - iterm2
    - lens
    - macfuse
    - mqtt-explorer
    - pycharm
    - raspberry-pi-imager
    - tailscale-app
    - veracrypt
    - visual-studio-code
    - yubico-authenticator
    # Communication / Collaboration
    - discord
    - obs
    - vlc
    - whatsapp
    - zoom
    # Utilities / Productivity
    - drawio
    - firefox
    - google-chrome
    - keepassxc
    - kopiaui
    - logi-options-plus
    - megasync
    - obsidian
    - openboardview
    - rectangle
    - sigil
    - spotify
    - surfshark
    - teamviewer
    - tor-browser
    - trezor-suite
    - transmission
# ==================================================
# Role: mas (prefer brew cask when possible)
# ==================================================
mas_upgrade_all_apps: true
mas_installed_apps:
    - name: AmorphousDiskMark
      id: 1168254295
    - name: GeoTag
      id: 1465180184
    - name: Keynote
      id: 409203825
    - name: Microsoft Excel
      id: 462058435
    - name: Microsoft PowerPoint
      id: 462062816
    - name: Microsoft Word
      id: 462054704
    - name: Numbers
      id: 409203825
    - name: Pages
      id: 409201541
    - name: Panorama Stitcher Mini
      id: 1062350226
    - name: Spherical Viewer
      id: 1489700765
    - name: Surfshark
      id: 1437809329
    - name: Trello
      id: 1278508951
    - name: WireGuard
      id: 1451685025
mas_uninstalled_apps:
    - name: GarageBand
      id: 682658836
    - name: iMovie
      id: 408981434
# ==================================================
# Role: python
# ==================================================
python_pyenv_versions:
    - 3.11.14
    - 3.14.2
python_pyenv_global: 3.14.2
python_uv_versions: []
python_uv_tools:
    - ansible
    - black
    - ruff
    - flake8
    - mypy
    - pre-commit
    - firefly-cli
    - isort
    - versioneer
# ==================================================
# Role: java
# ==================================================
java_versions: []
java_jenv_global: []
# ==================================================
# Role: dock
# ==================================================
dockitems_persist:
    - name: iTerm
      path: /Applications/iTerm.app
      pos: 1
    - name: Activity Monitor
      path: /System/Applications/Utilities/Activity Monitor.app
      pos: 2
    - name: Firefox
      path: /Applications/Firefox.app
      pos: 3
    - name: KeePassXC
      path: /Applications/KeePassXC.app
      pos: 4
    - name: Messages
      path: /System/Applications/Messages.app
      pos: 5
    - name: FaceTime
      path: /System/Applications/FaceTime.app
      pos: 6
    - name: WhatsApp
      path: /Applications/WhatsApp.app
      pos: 7
    - name: Calendar
      path: /System/Applications/Calendar.app
      pos: 8
    - name: Reminders
      path: /System/Applications/Reminders.app
      pos: 9
    - name: Stickies
      path: /System/Applications/Stickies.app
      pos: 10
    - name: Obsidian
      path: /Applications/Obsidian.app
      pos: 11
    - name: Spotify
      path: /Applications/Spotify.app
      pos: 12
    - name: Photos
      path: /System/Applications/Photos.app
      pos: 14
    - name: VSCode
      path: /Applications/Visual Studio Code.app
      pos: 15
    - name: PyCharm
      path: /Applications/PyCharm.app
      pos: 16
    - name: Docker
      path: /Applications/Docker.app
      pos: 17
    - name: Bruno
      path: /Applications/Bruno.app
      pos: 18
    - name: Adobe Lightroom Classic
      path: /Applications/Adobe Lightroom Classic/Adobe Lightroom Classic.app
      pos: 19
    - name: Adobe Bridge 2023
      path: /Applications/Adobe Bridge 2023/Adobe Bridge 2023.app
      pos: 20
    - name: System Settings
      path: /System/Applications/System Settings.app
      pos: 21
    - name: Applications
      path: /Applications
      pos: 22
    - name: Downloads
      path: /Users/{{ ansible_env.USER }}/Downloads
      pos: 23
# ==================================================
# Role: macos
# ==================================================
macos_ini_properties:
    # KeePassXC
    - path: $HOME/Library/Application Support/KeePassXC/keepassxc.ini
      section: General
      option: AutoReloadOnChange
      value: "false"
    - path: $HOME/Library/Application Support/KeePassXC/keepassxc.ini
      section: General
      option: AutoSaveAfterEveryChange
      value: "false"
    - path: $HOME/Library/Application Support/KeePassXC/keepassxc.ini
      section: General
      option: AutoSaveNonDataChanges
      value: "false"
    - path: $HOME/Library/Application Support/KeePassXC/keepassxc.ini
      section: General
      option: AutoSaveOnExit
      value: "false"
    - path: $HOME/Library/Application Support/KeePassXC/keepassxc.ini
      section: General
      option: AutoTypeDelay
      value: 50
    - path: $HOME/Library/Application Support/KeePassXC/keepassxc.ini
      section: General
      option: AutoTypeStartDelay
      value: 300
    - path: $HOME/Library/Application Support/KeePassXC/keepassxc.ini
      section: General
      option: BackupBeforeSave
      value: "true"
    - path: $HOME/Library/Application Support/KeePassXC/keepassxc.ini
      section: General
      option: ConfigVersion
      value: 2
    - path: $HOME/Library/Application Support/KeePassXC/keepassxc.ini
      section: General
      option: GlobalAutoTypeKey
      value: 80
    - path: $HOME/Library/Application Support/KeePassXC/keepassxc.ini
      section: General
      option: GlobalAutoTypeModifiers
      value: 201326592
    - path: $HOME/Library/Application Support/KeePassXC/keepassxc.ini
      section: General
      option: UpdateCheckMessageShown
      value: "true"
    - path: $HOME/Library/Application Support/KeePassXC/keepassxc.ini
      section: GUI
      option: TrayIconAppearance
      value: monochrome
    - path: $HOME/Library/Application Support/KeePassXC/keepassxc.ini
      section: PasswordGenerator
      option: AdvancedMode
      value: "true"
    - path: $HOME/Library/Application Support/KeePassXC/keepassxc.ini
      section: PasswordGenerator
      option: ExcludeAlike
      value: "false"
    - path: $HOME/Library/Application Support/KeePassXC/keepassxc.ini
      section: PasswordGenerator
      option: ExcludedChars
      value: '^`~;:'
    - path: $HOME/Library/Application Support/KeePassXC/keepassxc.ini
      section: PasswordGenerator
      option: Length
      value: 20
    - path: $HOME/Library/Application Support/KeePassXC/keepassxc.ini
      section: PasswordGenerator
      option: Logograms
      value: "true"
    - path: $HOME/Library/Application Support/KeePassXC/keepassxc.ini
      section: PasswordGenerator
      option: LowerCase
      value: "true"
    - path: $HOME/Library/Application Support/KeePassXC/keepassxc.ini
      section: PasswordGenerator
      option: Math
      value: "true"
    - path: $HOME/Library/Application Support/KeePassXC/keepassxc.ini
      section: PasswordGenerator
      option: Type
      value: 0
    - path: $HOME/Library/Application Support/KeePassXC/keepassxc.ini
      section: PasswordGenerator
      option: WordCount
      value: 2
    - path: $HOME/Library/Application Support/KeePassXC/keepassxc.ini
      section: Security
      option: ClearClipboardTimeout
      value: 60
    - path: $HOME/Library/Application Support/KeePassXC/keepassxc.ini
      section: Security
      option: EnableCopyOnDoubleClick
      value: "true"
    - path: $HOME/Library/Application Support/KeePassXC/keepassxc.ini
      section: Security
      option: HidePasswordPreviewPanel
      value: "false"
    - path: $HOME/Library/Application Support/KeePassXC/keepassxc.ini
      section: Security
      option: IconDownloadFallback
      value: "true"
    - path: $HOME/Library/Application Support/KeePassXC/keepassxc.ini
      section: Security
      option: PasswordsHidden
      value: "false"
    - path: $HOME/Library/Application Support/KeePassXC/keepassxc.ini
      section: Security
      option: PasswordsRepeatVisible
      value: "false"
# macos_hosts:
# - {ip: 127.0.0.1, hosts: tst}
# - {ip: 127.0.0.1, hosts: tst2}
# - {ip: 127.0.0.1, hosts: tst3}
# - {ip: 127.0.0.1, hosts: tst4}
macos_add_adobe_hosts: true
# macos_ssh_config:  # Moved to vars/ssh_config.enc.yml
# ==================================================
# Role: ide
# ==================================================
ide_vscode_extensions:
    - anan.jetbrains-darcula-theme
    - anthropic.claude-code
    - github.copilot
    - github.copilot-chat
    - github.vscode-github-actions
    - james-yu.latex-workshop
    - ms-kubernetes-tools.vscode-kubernetes-tools
    - ms-python.debugpy
    - ms-python.python
    - redhat.ansible
    - redhat.vscode-yaml
    - signageos.signageos-vscode-sops
    - vscode-icons-team.vscode-icons
sops:
    age:
        - recipient: age1n2g0g2z9jdgnqx826e8d0d78y8z0lc7ngdadm3jw9gzpxj2nf5rs0hm6p6
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQSG5wbDBEWXdVRHg5bm1N
            WHd4dHVrWUFzMnBNQ3Nzam9rWUdyQ0xVOUJJCjNTWmFXZG5PMFFTVzhza1NDYTZw
            NW56MVFGekRJRjhRRHJMSnlxTy9CWG8KLS0tIHIzVWkrLzFVbENzTENqZGdadjJm
            U3NMVW5sUUZZb3BCWlZoRGhQSkpDb1kKexQz9A+2Ti9VrfQCn8hqSVpcLimqy3L5
            7nQ7dCQhXXLQwYDPo+ziXzdE60L+/yBPFbij1yE2HsK3TOJEy2qnFg==
            -----END AGE ENCRYPTED FILE-----
    lastmodified: "2026-04-25T12:14:36Z"
    mac: ENC[AES256_GCM,data:r5PeH1RY3TpRAlk24VTbiJhqiQ53hC67ufzQE83BMjx8gheSPuGlPQq+6bbbLSAz9ZHUBXxksVYY5Us/F6mX+dnYG2MpsbcuVEHwL21/Hc4eEV6Zd5Wjia2zPkmuWg8PpOUC1ttjQEbJbebOJPzGCn4cHuV7h3nf9t4od+cOibs=,iv:14PjXVi/3qUU0uHfmIkZIhFRUnTKhg+9zJb0xVSeLIs=,tag:KMXFLeum8uTT3gxH4aiIvQ==,type:str]
    encrypted_regex: ^(dotfiles_auth_home|dotfiles_repo|dotfiles_secrets_src|dotfiles_secrets|dotfiles_zsh_extra_aliases)$
    mac_only_encrypted: true
    version: 3.12.2