---
# Domains
domain_base: ladkau.de
domain_cloud:      "cloud.{{ domain_base }}"
domain_gitea:      "gitea.{{ domain_base }}"
domain_nextcloud:  "nextcloud.{{ domain_base }}"
domain_sso:        "sso.{{ domain_base }}"
domain_mail:       "mail.{{ domain_base }}"
domain_registry:   "cr.{{ domain_base }}"
domain_k8s:        "k8s.{{ domain_base }}"
domain_vault:      "vault.{{ domain_base }}"
domain_dl:         "dl.{{ domain_base }}"

# Let's Encrypt
acme_email: matthias.ladkau@gmail.com

# Non-root deploy user created by the base role
deploy_user: deploy

# System timezone
timezone: Europe/Berlin

# Docker network shared by all services and Traefik
traefik_network: traefik_public

# Traefik
traefik_version: v3.6
traefik_data_dir: /opt/traefik
# Dashboard basic-auth users — plaintext passwords, Ansible generates bcrypt hashes at deploy time
# traefik_dashboard_users:
#   - username: admin
#     password: "your-password"
traefik_dashboard_users: []

# Gitea
gitea_version: "1"          # major-only tag — always pulls latest 1.x patch
gitea_db_version: "16"      # PostgreSQL major version
gitea_data_dir: /opt/gitea
# Secrets — store values in ansible/group_vars/all/vault.yml (Ansible Vault)
# gitea_db_password: ""
# gitea_secret_key: ""      # generate: openssl rand -hex 32
# gitea_internal_token: ""  # generate: openssl rand -hex 32

# SSO (Keycloak)
keycloak_version: "26.2"
keycloak_db_version: "16"
sso_data_dir: /opt/sso
keycloak_admin_user: admin
# Secrets — store values in ansible/group_vars/all/vault.yml (Ansible Vault)
# keycloak_db_password: ""
# keycloak_admin_password: ""

# Nextcloud
nextcloud_version: "31-apache"  # apache variant includes a working web server
nextcloud_db_version: "16"
nextcloud_data_dir: /opt/nextcloud
nextcloud_admin_user: admin
# Secrets — store values in ansible/group_vars/all/vault.yml (Ansible Vault)
# nextcloud_db_password: ""
# nextcloud_admin_password: ""

# Mail (Roundcube + Dovecot IMAP + Fetchmail)
roundcube_version: "1.6.x-apache"
roundcube_db_version: "16"
mail_data_dir: /opt/mail
# Dovecot IMAP server — Roundcube always connects to the local Dovecot container
dovecot_version: "2.3"
# SMTP — outgoing mail server for Roundcube (leave empty if not configured)
roundcube_smtp_host: ""
roundcube_smtp_port: "587"
# Fetchmail — polls external POP3 accounts and delivers to local Dovecot via LMTP
# poll_minutes is per-account (default: 10 minutes)
# Secrets — store values in ansible/group_vars/all/vault.yml (Ansible Vault)
# roundcube_db_password: ""
# roundcube_des_key: ""   # generate: openssl rand -hex 12  (must be exactly 24 chars)
#
# Dovecot users — list of {username, password} pairs (plaintext, vault is encrypted)
# dovecot_users:
#   - username: alice
#     password: "plaintext-password"
#
# Fetchmail accounts — list of external POP3 sources to poll
# fetchmail_accounts:
#   - server: pop.gmail.com
#     username: user@gmail.com
#     password: app-password
#     local_user: alice
#     protocol: pop3      # default: pop3
#     ssl: true           # default: true
#     keep: true          # default: true — set false to delete from source after fetch

# Gitea Actions runners (act_runner with Docker executor)
act_runner_version: "latest"
act_runner_data_dir: /opt/act_runner
act_runner_count: 3
# Secrets — store values in ansible/group_vars/all/vault.yml (Ansible Vault)
# gitea_runner_registration_token: ""  # Gitea admin → Site Administration → Runners → Create runner token

# Container registry (Docker Registry v2 + web UI)
registry_data_dir: /opt/registry
registry_ui_version: "main"
# Registry users — plaintext passwords, Ansible generates bcrypt hashes at deploy time
# registry_users:
#   - username: alice
#     password: "your-password"

# k8s (placeholder)
k8s_data_dir: /opt/k8s

# Vaultwarden (self-hosted Bitwarden-compatible password vault)
vaultwarden_version: "latest"
vaultwarden_data_dir: /opt/vaultwarden
# Secrets — store values in ansible/group_vars/all/vault.yml (Ansible Vault)
# vaultwarden_admin_token: ""       # generate: openssl rand -hex 32
# vaultwarden_sso_client_secret: "" # added after Keycloak is configured — see runbook-configuration.md step 2.6

# Download server (nginx HTTPS + SFTP)
dl_data_dir: /opt/dl
dl_upload_user: uploader
dl_sftp_port: 2223
# Secrets — store values in ansible/group_vars/all/vault.yml (Ansible Vault)
# dl_sftp_authorized_keys: |
#   ssh-ed25519 AAAA...  gitea-actions

# Status dashboard (public — cloud.ladkau.de root)
dashboard_data_dir: /opt/dashboard