gvm/gvmrc.example

# Example gvm configuration. gvm writes a ~/.gvmrc of this shape on first run;
# fill in the passwords and it is ready. This file is the annotated reference.
#
# Simple "key = value" (or "key: value") lines; a '#' after whitespace starts a
# comment. Settings are resolved in this order, each step overriding the one
# before:
#
#   ~/.gvmrc  ->  GVM_* environment variables
#
# The file holds vCenter passwords, so it wants to be mode 0600 — gvm creates it
# that way and complains when it finds it readable by others.
#
# A password written here in the clear is sealed on the next run of gvm and
# replaced by a "gvmenc1:..." word, so it does not stand in this file where a
# backup, a synced home directory or an editor's swap file would pick it up.
# "gvm config -p v308" asks for one instead and writes it sealed straight away,
# which is the way to set one without it ever being on disk in the clear.
#
# What that is: the password is not in plain sight. What it is not: a vault.
# The key is compiled into gvm and is the same in every copy, so whoever holds
# this file *and* a gvm binary can open the value. The 0600 is what keeps other
# users out.

# The vCenter used when -v is not given. `gvm` and `gvm vm -l` ignore it and ask
# every configured server; the rest work on exactly one.
#
# -v takes a list for the commands that sweep — `-v v308,v108` — and refuses one
# for the commands that act on a single machine.
default = v308

# --- one 'vcenter.<name>.*' block per server ---
#
# <name> is what -v selects and what shows up in the VM listing's own column, so
# keep it short. url, user, password and datacenter are required; a block that
# is missing one of them is reported and skipped, not silently ignored.
#
# insecure = true skips verification of the server certificate. vCenter installs
# usually carry a self-signed one, so this is usually needed — it is written
# down per server rather than assumed, which is the one thing the rewrite
# changed: the old code passed insecure=true to every connection it made.

vcenter.v308.url        = https://v308.fhi.mpg.de/
vcenter.v308.user       = administrator@v308.fhi.mpg.de
vcenter.v308.password   = <password>      # sealed on the next run
vcenter.v308.datacenter = PPB
vcenter.v308.insecure   = true

vcenter.v108.url        = https://v108.rz-berlin.mpg.de/
vcenter.v108.user       = administrator@v108.local
vcenter.v108.password   = <password>
vcenter.v108.datacenter = PPB
vcenter.v108.insecure   = true

vcenter.v38.url         = https://v38.rz-berlin.mpg.de/
vcenter.v38.user        = administrator@v38.local
vcenter.v38.password    = <password>
vcenter.v38.datacenter  = FEL
vcenter.v38.insecure    = true

# --- mail, for `gvm log -m` and `gvm snap --old -m` ---
# Without these, both say so before they query anything.
mailfrom  = root@fhi.mpg.de
mailto    = mw@pstbx.org
smtphost  = m0.fhi-berlin.mpg.de
smtpport  = 25

# --- telemetry, for `gvm host -t` and `gvm ds -t` ---
# Where the per-host and per-datastore numbers are posted. Unset (or without
# -t) nothing is sent. The lines are prefixed "vm," and "ds," respectively.
telemetry = http://monitor.rz-berlin.mpg.de/telemetry.php

# --- what a machine made from a template is told about the network ---
# The site's answers, written once: every machine made from a template gets the
# same domain, the same resolvers, the same mask and the same gateway, and only
# its own name and address differ. Those two are typed:
#
#   gvm new --from ubuntu-tpl --name web05 --ip 10.0.0.55
#
# Linux only — a Windows guest needs a Sysprep, which is a licence key and an
# administrator password, and that belongs in a customisation specification in
# the vCenter (gvm new --spec). `gvm config` shows what would be written and
# names whatever is still missing.
# domain    = example.org
# dns       = 10.0.0.1, 10.0.0.2
# netmask   = 255.255.255.0
# gateway   = 10.0.0.1
# timezone  = Europe/Berlin
#
# The address can be fetched instead of typed, where the site has a tool for it:
#
#   gvm new --from ubuntu-tpl --name web05 --ip auto
#
# gvm looks for "dns" on the path and offers that only where it finds one, and
# only from v2.5.0 — older ones answer in sentences rather than JSON and are
# said to be too old rather than read. Name it here where it lives somewhere
# else. It is asked for an address under the
# machine's own name, and the address is given back if the deployment does not
# happen after all.
# dnstool   = /usr/local/bin/dns

# --- ssh, for the sheet's 'h' ---
# The command that logs in to a machine's guest from its sheet. "%h" is where
# the guest's own hostname — or its address, when it reports no name — is put;
# it is appended when %h is not written anywhere. Unset means "ssh root@%h",
# which is what one logs in to these machines as; a line here replaces it whole,
# root and all.
#
# The target is always one argument and never goes through a shell: it is a name
# the guest chose for itself, and gvm does not run it as a command.
# ssh = ssh -l someone %h

# --- the same settings from the environment ---
# Every setting above has an environment spelling that wins over the file:
#
#   GVM_DEFAULT, GVM_MAILFROM, GVM_MAILTO, GVM_SMTPHOST, GVM_SMTPPORT,
#   GVM_TELEMETRY, GVM_SSH, GVM_DOMAIN, GVM_DNS, GVM_NETMASK, GVM_GATEWAY,
#   GVM_TIMEZONE, GVM_DNSTOOL
#   GVM_VCENTER_<NAME>_<FIELD>, e.g. GVM_VCENTER_V308_PASSWORD
#
# which is the way to keep a password out of a file altogether — under cron,
# say, with the secret coming from somewhere else.
#
# GVM_NO_UPDATE_CHECK=1 turns off the once-a-day look for a new version.