---
# Domains
domain_base: ladkau.de
domain_cloud:      "cloud.{{ domain_base }}"
domain_gitea:      "gitea.{{ domain_base }}"
domain_nextcloud:  "nextcloud.{{ domain_base }}"
domain_sso:        "sso.{{ domain_base }}"
domain_mail:       "mail.{{ domain_base }}"
domain_registry:   "cr.{{ domain_base }}"
domain_k8s:        "k8s.{{ domain_base }}"

# Let's Encrypt
acme_email: matthias.ladkau@gmail.com

# Non-root deploy user created by the base role
deploy_user: deploy

# System timezone
timezone: Europe/Berlin

# Docker network shared by all services and Traefik
traefik_network: traefik_public

# Traefik
traefik_version: v3.6
traefik_data_dir: /opt/traefik
# htpasswd-formatted user list for the dashboard.
# Generate with: echo $(htpasswd -nB admin) | sed -e 's/\$/\$\$/g'
# Store the actual value in ansible/group_vars/all/vault.yml (Ansible Vault).
traefik_dashboard_users: ""

# Gitea
gitea_version: "1"          # major-only tag — always pulls latest 1.x patch
gitea_db_version: "16"      # PostgreSQL major version
gitea_data_dir: /opt/gitea
# Set to false for the very first deploy so the admin account can be created,
# then flip to true and redeploy to close public registration.
gitea_disable_registration: true
# Secrets — store values in ansible/group_vars/all/vault.yml (Ansible Vault)
# gitea_db_password: ""
# gitea_secret_key: ""      # generate: openssl rand -hex 32
# gitea_internal_token: ""  # generate: openssl rand -hex 32

# SSO (Keycloak)
keycloak_version: "26.2"
keycloak_db_version: "16"
sso_data_dir: /opt/sso
keycloak_admin_user: admin
# Secrets — store values in ansible/group_vars/all/vault.yml (Ansible Vault)
# keycloak_db_password: ""
# keycloak_admin_password: ""

# Nextcloud
nextcloud_version: "31-apache"  # apache variant includes a working web server
nextcloud_db_version: "16"
nextcloud_data_dir: /opt/nextcloud
nextcloud_admin_user: admin
# Secrets — store values in ansible/group_vars/all/vault.yml (Ansible Vault)
# nextcloud_db_password: ""
# nextcloud_admin_password: ""

# Mail (Roundcube webmail client)
roundcube_version: "1.6.x-apache"
roundcube_db_version: "16"
mail_data_dir: /opt/mail
# IMAP/SMTP — set to the mail server Roundcube should connect to.
# Leave imap_host empty to let users enter their own server at login.
# Use "ssl://hostname" for implicit TLS (port 993), or plain hostname for STARTTLS (port 143).
roundcube_imap_host: ""
roundcube_imap_port: "993"
roundcube_smtp_host: ""
roundcube_smtp_port: "587"
# Secrets — store values in ansible/group_vars/all/vault.yml (Ansible Vault)
# roundcube_db_password: ""
# roundcube_des_key: ""   # generate: openssl rand -hex 12  (must be exactly 24 chars)

# Container registry (Docker Registry v2)
registry_data_dir: /opt/registry
# registry_htpasswd — full htpasswd file content, store in vault.yml
# Generate with: docker run --entrypoint htpasswd httpd:2 -Bbn <user> <password>
# Multiple users: run the command once per user and concatenate the lines.
# Secrets — store values in ansible/group_vars/all/vault.yml (Ansible Vault)
# registry_htpasswd: ""

# k8s (placeholder)
k8s_data_dir: /opt/k8s

# Status dashboard (public — cloud.ladkau.de root)
dashboard_data_dir: /opt/dashboard