---
ansible_python_interpreter: /usr/local/bin/python3 # Force the managed Python used by this stack; avoids distro-default interpreter/module mismatches.
ansible_shell_executable: /bin/bash # Required so shell tasks with `set -euo pipefail` do not fail on distros where /bin/sh is dash.

SOFTWARE_NAME: "Infinito.Nexus" # Name of the software
SOFTWARE_DOMAIN: "{{ SOFTWARE_NAME | lower }}" # Software domain
SOFTWARE_URL: "https://{{ SOFTWARE_DOMAIN }}" # Url of the software provicer

ORGANIZATION: "{{ SOFTWARE_NAME }}"

ENVIRONMENT: "production" # Possible values: production, development
RUNTIME: "host" # Where does this instance run in? Valid: act, github, dev, host
STORAGE_CONSTRAINED: false # Storage constraint means that Infinito.Nexus prefers free storage space over cache

MASK_CREDENTIALS_IN_LOGS: true

HOST_CURRENCY: "EUR"
HOST_TIMEZONE: "UTC"
HOST_TIMEZONE_LABEL: "United Kingdom"

HOST_LL: "en" # Some applications are case sensitive
HOST_LL_CC: "{{HOST_LL}}_GB"
HOST_LL_CC_TAG: "{{ HOST_LL_CC | lower | replace('_', '-') }}" # BCP-47 / IETF language tag form (e.g. "en-gb"), as used by web apps and JSON config
HOST_CS: "UTF-8"
HOST_LANG: "{{HOST_LL_CC}}.{{HOST_CS}}"

HOST_DATE_FORMAT: "YYYY-MM-DD"
HOST_TIME_FORMAT: "HH:mm"

WWW_REDIRECT_ENABLED: "{{ ('web-opt-rdr-www' in group_names) | bool }}"

AUTO_BUILD_ALIASES: false # If enabled it creates an alias domain for each web application by the entity name, recommended to set to false to safe domain space

DOMAIN_PRIMARY: "infinito.localhost" # Primary Domain of the server
DOMAIN_TEST: "test.{{ DOMAIN_PRIMARY }}"
DOMAIN_HOMEPAGE: "{{ lookup('domain','web-app-dashboard') if 'web-app-dashboard' in group_names else SOFTWARE_DOMAIN }}"

DNS_PROVIDER: "localhost" # The DNS Provider\Registrar for the domain -> Legit values: cloudflare

HOSTING_PROVIDER: "localhost" # Provider which hosts the server -> hetzner

MAIL_PROVIDER: "web-app-stalwart" # Active mail provider role. Set to web-app-mailu to use Mailu instead of Stalwart.

MAIL_PRODUCTION_HOST: "" # Public FQDN of a reachable mail server; when set, the provider asserts its live DNS/TLS/SMTP hard facts.
MAIL_PRODUCTION_RESOLVER: "" # Resolver those assertions query; empty uses the host's /etc/resolv.conf.

DOCKER_IN_CONTAINER: "{{ (ansible_facts['env']['container'] | default('')) != '' }}"
DOCKER_RESTART_POLICY: "unless-stopped" # Default restart parameter for docker containers
DOCKER_WHITELISTET_ANON_VOLUMES: [] # Volumes which should be ignored during docker anonymous health check
DOCKER_BIND_HOST: "{{ '0.0.0.0' if DOCKER_IN_CONTAINER | bool else '127.0.0.1'}}" # Host to which docker containers publish ports to
DOCKER_PUBLIC_BIND_HOST: "{{ '0.0.0.0' if DOCKER_IN_CONTAINER | bool else networks.internet.ip4 }}" # Host IP for intentionally public service bindings
DOCKER_REACH_HOST: "127.0.0.1" # Default localhost, will be overwritten if DOCKER_IN_CONTAINER with Docker Bridge Gateway
BUILDKIT_ENABLED: true # When falsy the compose wrapper forces the legacy builder (DOCKER_BUILDKIT=0); needed in offline/sandbox-blocked registries

ASYNC_ENABLED: "{{ not MODE_DEBUG | bool }}" # Activate async, deactivated for debugging
ASYNC_TIME: "{{ 300 if ASYNC_ENABLED | bool else omit }}" # Run for max 5min
ASYNC_POLL: "{{ 0 if ASYNC_ENABLED | bool else 10 }}" # Don't wait for task

APPLICATIONS_WHITELIST: [] # nocheck: unused-var

PRIMARY_APPS: [] # Apps this deploy was asked for; the rest of the round is their dependency closure.

RBAC:
  GROUP:
    NAME: "/roles" # Name of the group which holds the RBAC roles
    CLAIM: "groups" # Name of the claim containing the RBAC groups

CAPTCHA:
  RECAPTCHA:
    KEY: ""
    SECRET: ""
  HCAPTCHA:
    KEY: ""
    SECRET: ""

RECAPTCHA_ENABLED: "{{ (CAPTCHA.RECAPTCHA.KEY | length > 0) and (CAPTCHA.RECAPTCHA.SECRET | length > 0) }}"

HCAPTCHA_ENABLED: "{{ (CAPTCHA.HCAPTCHA.KEY | length > 0) and (CAPTCHA.HCAPTCHA.SECRET | length > 0) }}"

WORKSTATION_USER: "administrator"