---
# ---------------------------------------------------------------------------
# Rootless Podman / Quadlet
# ---------------------------------------------------------------------------
# Duplicated from caddy/vars/default.yml (which also sets `host_directory` for
# Caddy, so it cannot be included wholesale). Keep the three in sync. Its fourth,
# podman_unprivileged_port_start, is not needed here: Nextcloud publishes nothing
# host-side.
podman_user: "{{ ansible_facts['user_id'] }}"
podman_data_dir: "{{ ansible_facts['user_dir'] }}/podman-data"
quadlet_dir: "{{ ansible_facts['user_dir'] }}/.config/containers/systemd"

# ---------------------------------------------------------------------------
# Nextcloud
# ---------------------------------------------------------------------------
# The site's hostname: what Caddy serves, and the trusted domain for an unattended
# install.
host: cloud.hopsngrains.com

container_name: nextcloud
unit_name: "{{ container_name }}.service"

# Fully qualified: rootless Podman resolves short names against
# unqualified-search-registries, and a unit has no TTY to answer the prompt.
image: docker.io/library/nextcloud:latest

# caddy/roles/register pins the Podman network name to <network_name>_net, so the
# file is nextcloud.network and the network is nextcloud_net.
network_name: "{{ container_name }}"

# The image's VOLUME and Apache document root, and — unlike the other services
# here — the code as well as the state: config.php, data/, custom_apps/ and every
# PHP file live under it. See readme.md, "What is state, and what is not".
host_directory: "{{ podman_data_dir }}/{{ container_name }}"
webroot: /var/www/html

# www-data. The entrypoint rsyncs the code in as this uid and Apache runs its
# workers as it, so this is the one uid to map onto the connection user.
app_uid: 33
app_gid: 33

# Apache's port inside the container, and the one Caddy proxies to.
container_port: 80

env_file: "{{ host_directory }}/nextcloud.env"

# ---------------------------------------------------------------------------
# Shared services (each its own playbook)
# ---------------------------------------------------------------------------
# Postgres, and the alias its attach role adds.
postgres_container: postgres
postgres_unit: "{{ postgres_container }}.service"
db_host: db

# The database this play creates if it is missing, and the credentials in
# postgres/vars/default.yml that the cluster was initialised with.
pg_user: postgres
pg_password: '123456'
pg_database: nextcloud

# Valkey, and the alias its attach role adds. REDIS_HOST is not cosmetic:
# config.php puts `memcache.locking` on Redis, so an unresolvable `redis` breaks
# uploads rather than merely slowing them down.
valkey_container: valkey
valkey_unit: "{{ valkey_container }}.service"
redis_host: redis

caddy_name: caddy
caddyfile_path: "{{ podman_data_dir }}/{{ caddy_name }}/conf/Caddyfile"

# ---------------------------------------------------------------------------
# First-run install (optional)
# ---------------------------------------------------------------------------
# Empty by default: a fresh webroot is initialised by the image and the setup
# wizard takes over. Set both to have the image install unattended instead, with
# trusted_domains set from `host`. Inert once config.php exists.
nextcloud_admin_user: ""
nextcloud_admin_password: ""

# ---------------------------------------------------------------------------
# Background jobs
# ---------------------------------------------------------------------------
cron_unit: "{{ container_name }}-cron"
cron_schedule: "*:0/5"
user_unit_dir: "{{ ansible_facts['user_dir'] }}/.config/systemd/user"

# ---------------------------------------------------------------------------
# Caddy site block
# ---------------------------------------------------------------------------
snippet_block: |
  {{ host }} {
      reverse_proxy {{ container_name }}:{{ container_port }}

      header {
          Strict-Transport-Security "max-age=15552000; includeSubDomains; preload"
      }
  }