---
# LiveKit runs in host network mode (7880/7881 not Docker-mapped). The
# controller uses the dedicated confidential Keycloak client
# `opentalk-controller` because the shared `infinito.nexus` client is public
# and cannot introspect access tokens; the same client doubles as the admin
# Web API user-search backend (serviceAccountsEnabled + view-users role).
# OPENTALK_OPENCLOUD_URL is gated behind group_names because the `tls`
# lookup raises for roles outside the current host's scope.
application_id: "web-app-opentalk"
entity_name: "{{ application_id | get_entity_name }}"

OPENTALK_CTRL_CONTAINER: "{{ lookup('config', application_id, 'services.controller.name') }}"
OPENTALK_CTRL_HTTP_PORT: "{{ lookup('config', application_id, 'services.controller.ports.local.http') }}"
OPENTALK_CTRL_INTERNAL_PORT: "{{ lookup('config', application_id, 'services.controller.ports.internal.http') }}"
OPENTALK_CTRL_SERVICE_API_KEY_ID: "controller"
OPENTALK_CTRL_SERVICE_API_SECRET: "{{ lookup('config', application_id, 'secrets.credentials.service_api_secret') }}"

OPENTALK_FRONTEND_CONTAINER: "{{ lookup('config', application_id, 'services.opentalk.name') }}"
OPENTALK_FRONTEND_HTTP_PORT: "{{ lookup('config', application_id, 'services.opentalk.ports.local.http') }}"

OPENTALK_LIVEKIT_CONTAINER: "{{ lookup('config', application_id, 'services.livekit.name') }}"
OPENTALK_LIVEKIT_HTTP_PORT: "{{ lookup('config', application_id, 'services.livekit.ports.internal.http') }}"
OPENTALK_LIVEKIT_TCP_PORT: "{{ lookup('config', application_id, 'services.livekit.ports.internal.tcp') }}"
OPENTALK_LIVEKIT_TURN_UDP_PORT: "{{ lookup('config', application_id, 'services.livekit.ports.public.stun_turn') }}"
OPENTALK_LIVEKIT_RTC_START: "{{ lookup('config', application_id, 'services.livekit.ports.public.relay.start') }}"
OPENTALK_LIVEKIT_RTC_END: "{{ lookup('config', application_id, 'services.livekit.ports.public.relay.end') }}"

OPENTALK_URL: "{{ lookup('tls', application_id, 'url.base') }}"
OPENTALK_DOMAIN: "{{ lookup('domain', application_id) }}"

OPENTALK_OIDC_ENABLED: "{{ lookup('config', application_id, 'services.sso.enabled') }}"

OPENTALK_LIVEKIT_API_KEY: "controller"
OPENTALK_LIVEKIT_API_SECRET: "{{ lookup('config', application_id, 'secrets.credentials.livekit_api_secret') }}"

OPENTALK_OBJSTORE_CONTAINER_ADDRESS: "{{ lookup('container_address', application_id, lookup('objstore', application_id, 'engine')) }}"

OPENTALK_RABBIT_CONTAINER: "{{ lookup('config', application_id, 'services.rabbit.name') }}"

OPENTALK_RECORDER_CONTAINER: "{{ lookup('config', application_id, 'services.recorder.name') }}"
OPENTALK_RECORDER_HTTP_PORT: "{{ lookup('config', application_id, 'services.recorder.ports.internal.http') }}"
OPENTALK_RECORDER_API_KEY_ID: "recorder"
OPENTALK_RECORDER_API_SECRET: "{{ lookup('config', application_id, 'secrets.credentials.recorder_api_secret') }}"

OPENTALK_KEYCLOAK_BASE_URL: "{{ lookup('tls', 'web-app-keycloak', 'url.base') | regex_replace('/+$','') }}"
OPENTALK_KEYCLOAK_CONTAINER_ADDRESS: "{{ lookup('container_address', 'web-app-keycloak', 'keycloak') }}"
OPENTALK_KEYCLOAK_REALM: "{{ OIDC.CLIENT.REALM }}"

OPENTALK_CTRL_OIDC_CLIENT_ID: "opentalk-controller"
OPENTALK_CTRL_OIDC_CLIENT_SECRET: "{{ lookup('config', application_id, 'secrets.credentials.controller_oidc_client_secret') }}"

OPENTALK_KEYCLOAK_CLIENT_ID: "{{ OPENTALK_CTRL_OIDC_CLIENT_ID }}"
OPENTALK_KEYCLOAK_CLIENT_SECRET: "{{ OPENTALK_CTRL_OIDC_CLIENT_SECRET }}"

OPENTALK_OPENCLOUD_ENABLED: "{{ ('web-app-opencloud' in group_names) | lower }}"
OPENTALK_OPENCLOUD_URL: "{{ lookup('tls', 'web-app-opencloud', 'url.base') if OPENTALK_OPENCLOUD_ENABLED | bool else '' }}"