---
application_id: "web-app-gitlab"
entity_name: "{{ application_id | get_entity_name }}"

swarm_stack_converge_retries: 600

GITLAB_URL: "{{ lookup('tls', application_id, 'url.base') }}"
GITLAB_HOSTNAME: "{{ lookup('container_hostname', application_id) }}"
GITLAB_TLS_ENABLED: "{{ lookup('tls', application_id, 'enabled') | bool }}"
GITLAB_WEB_PORT: "{{ lookup('tls', application_id, 'ports.web') }}"

GITLAB_SSH_PORT: "{{ lookup('config', application_id, 'services.gitlab.ports.public.ssh') }}"
GITLAB_WORKHORSE_PORT: "{{ lookup('config', application_id, 'services.gitlab.ports.internal.http') }}"
GITLAB_SSHD_PORT: "{{ lookup('config', application_id, 'services.gitlab.ports.internal.ssh') }}"
GITLAB_WEBSERVICE_PORT: "{{ lookup('config', application_id, 'services.webservice.ports.internal.http') }}"
GITLAB_GITALY_PORT: "{{ lookup('config', application_id, 'services.gitaly.ports.internal.grpc') }}"
GITLAB_SIDEKIQ_HEALTH_PORT: "{{ lookup('config', application_id, 'services.sidekiq.ports.internal.http') }}"
GITLAB_SHELL_METRICS_PORT: "{{ lookup('config', application_id, 'services.shell.ports.internal.metrics') }}"

GITLAB_EMAIL: "{{ lookup('email', application_id) }}"
GITLAB_EMAIL_ENABLED: "{{ GITLAB_EMAIL.enabled | bool }}"
GITLAB_EMAIL_CA_FILE: "{{ CA_TRUST.inject_cert_container if lookup('ca_injected', application_id) else '' }}"

GITLAB_OIDC_ENABLED: "{{ lookup('config', application_id, 'services.sso.enabled') }}"
GITLAB_OIDC_LABEL: "{{ OIDC.BUTTON_TEXT }}"
GITLAB_OIDC_UID_FIELD: "{{ OIDC.ATTRIBUTES.USERNAME }}"
GITLAB_OIDC_CLIENT_ID: "{{ OIDC.CLIENT.ID }}"
GITLAB_OIDC_CLIENT_SECRET: "{{ OIDC.CLIENT.SECRET }}"
GITLAB_OIDC_ISSUER: "{{ OIDC.CLIENT.ISSUER_URL }}"
GITLAB_OIDC_REDIRECT_URI: "{{ (GITLAB_URL | regex_replace('/$', '')) ~ '/users/auth/openid_connect/callback' }}"

GITLAB_INIT_ROOT_PASSWORD: "{{ lookup('users', 'administrator').password }}"

GITLAB_MCP_ENABLED: "{{ lookup('config', application_id, 'services.gitlabmcp.enabled') | bool }}"
GITLAB_MCP_PATH: "{{ GITLAB_MCP_UPSTREAM_PATH }}"
GITLAB_MCP_TOKEN_NAME: "infinito-mcp"
GITLAB_MCP_ACCOUNT: "{{ lookup('users', 'mcp-web-app-gitlab') }}"
GITLAB_MCP_TOKEN_OWNER: "{{ GITLAB_MCP_ACCOUNT.username }}"
GITLAB_MCP_TOKEN_OWNER_NAME: "Infinito MCP"
GITLAB_MCP_TOKEN_OWNER_EMAIL: "{{ GITLAB_MCP_ACCOUNT.email }}"
GITLAB_MCP_TOKEN_OWNER_PASSWORD: "{{ GITLAB_MCP_ACCOUNT.password }}"
GITLAB_RAILS_BIN: "/srv/gitlab/bin/rails" # nocheck: literal-path  CNG images ship no omnibus gitlab-rails wrapper
GITLAB_MCP_TOKEN_LIFETIME_DAYS: 364
GITLAB_MCP_PROTOCOL_VERSION: "2025-06-18"

GITLAB_OBJSTORE_ENABLED: "{{ lookup('objstore', application_id, 'enabled') | bool }}"
GITLAB_OBJSTORE_BUCKET: "{{ lookup('objstore', application_id, 'bucket') }}"
GITLAB_OBJSTORE_ACCESS_KEY: "{{ lookup('objstore', application_id, 'access_key') }}"
GITLAB_OBJSTORE_SECRET_KEY: "{{ lookup('objstore', application_id, 'secret_key') }}"
GITLAB_OBJSTORE_ENDPOINT: "{{ lookup('objstore', application_id, 'url') }}"
GITLAB_OBJSTORE_REGION: "{{ lookup('objstore', application_id, 'region') }}"

GITLAB_REDIS_HOST: "{{ lookup('engine', 'redis', application_id, 'host') }}"
GITLAB_REDIS_PORT: "{{ lookup('engine', 'redis', application_id, 'port') }}"
GITLAB_REDIS_PASSWORD: "{{ lookup('engine', 'redis', application_id, 'password') }}"
GITLAB_REDIS_URL: "redis://{% if GITLAB_REDIS_PASSWORD %}:{{ GITLAB_REDIS_PASSWORD | urlencode }}@{% endif %}{{ GITLAB_REDIS_HOST }}:{{ GITLAB_REDIS_PORT }}"

GITLAB_SHELL_SECRET: "{{ lookup('config', application_id, 'secrets.credentials.gitlab_shell_secret') }}"
GITLAB_GITALY_TOKEN: "{{ lookup('config', application_id, 'secrets.credentials.gitaly_token') }}"
GITLAB_WORKHORSE_SECRET: "{{ lookup('config', application_id, 'secrets.credentials.workhorse_secret') }}"

GITLAB_CONFIG_DIR: "{{ lookup('container', application_id, 'directories.config') }}"
GITLAB_CONFIG_RAILS_DIR: "{{ [GITLAB_CONFIG_DIR, 'rails'] | path_join }}"
GITLAB_CONFIG_SECRETS_DIR: "{{ [GITLAB_CONFIG_DIR, 'secrets'] | path_join }}"
GITLAB_CONFIG_WORKHORSE_DIR: "{{ [GITLAB_CONFIG_DIR, 'workhorse'] | path_join }}"
GITLAB_CONFIG_SHELL_DIR: "{{ [GITLAB_CONFIG_DIR, 'shell'] | path_join }}"
GITLAB_CONFIG_GITALY_DIR: "{{ [GITLAB_CONFIG_DIR, 'gitaly'] | path_join }}"
GITLAB_CONFIG_HOSTKEYS_DIR: "{{ [GITLAB_CONFIG_DIR, 'hostkeys'] | path_join }}"

GITLAB_WEBSERVICE_SERVICE_NAME: "webservice"
GITLAB_SIDEKIQ_SERVICE_NAME: "sidekiq"
GITLAB_WORKHORSE_SERVICE_NAME: "workhorse"
GITLAB_GITALY_SERVICE_NAME: "gitaly"
GITLAB_SHELL_SERVICE_NAME: "shell"
GITLAB_MIGRATIONS_SERVICE_NAME: "migrations"

GITLAB_WEBSERVICE_CONTAINER: "{{ lookup('config', application_id, 'services.webservice.name') }}"
GITLAB_SIDEKIQ_CONTAINER: "{{ lookup('config', application_id, 'services.sidekiq.name') }}"
GITLAB_WORKHORSE_CONTAINER: "{{ lookup('config', application_id, 'services.workhorse.name') }}"
GITLAB_GITALY_CONTAINER: "{{ lookup('config', application_id, 'services.gitaly.name') }}"
GITLAB_SHELL_CONTAINER: "{{ lookup('config', application_id, 'services.shell.name') }}"
GITLAB_MIGRATIONS_CONTAINER: "{{ lookup('config', application_id, 'services.migrations.name') }}"

GITLAB_MCP_CONTAINER: "{{ lookup('config', application_id, 'services.gitlabmcp.name') }}"
GITLAB_MCP_PORT: "{{ lookup('config', application_id, 'services.gitlabmcp.ports.internal.http') }}"
GITLAB_MCP_INSTANCE_DIR: "{{ [lookup('container', application_id, 'directories.instance'), 'mcp'] | path_join }}"
GITLAB_MCP_UPSTREAM_HOST: "{{ GITLAB_WORKHORSE_SERVICE_NAME }}"
GITLAB_MCP_UPSTREAM_PATH: "{{ lookup('config', application_id, 'mcp.adapter.upstream_path') }}"
GITLAB_MCP_UPSTREAM_URL: "http://{{ GITLAB_MCP_UPSTREAM_HOST }}:{{ GITLAB_WORKHORSE_PORT }}{{ GITLAB_MCP_UPSTREAM_PATH }}"
GITLAB_MCP_BEARER: "{{ lookup('config', application_id, 'secrets.credentials.mcp_bearer') }}"
GITLAB_MCP_CONTRACT:
  upstream_kind: mcp
  provider: "{{ application_id }}"
  upstream_url: "{{ GITLAB_MCP_UPSTREAM_URL }}"
  auth_subject: "{{ lookup('config', application_id, 'mcp.auth_subject') }}"
  mutating_tools_enabled: "{{ lookup('config', application_id, 'mcp.tools.mutating_tools_enabled') | bool }}"
  tools: "{{ lookup('file', 'mcp/tools.json') | from_json }}"
  limits: "{{ lookup('config', application_id, 'mcp.limits') }}"
  schema_sha256: "{{ lookup('config', application_id, 'mcp.tools.schema_sha256') }}"