---
# ---------------------------------------------------------------------------
# Rootless Podman / Quadlet
# ---------------------------------------------------------------------------
# The container user is derived from the connection: this play carries no
# become, so the modules run as — and the Quadlet units belong to — whoever
# Ansible connects as. Requires gather_facts (set explicitly in playbook.yml).
#
# To use a different user you would have to reintroduce become_user, which is
# exactly what this design avoids; the podman role fails loudly if the resolved
# user is root.
podman_user: "{{ ansible_facts['user_id'] }}"

# State and config live in the user's home, not /var/lib. Taken from the
# user_dir fact, so this is correct even for users whose home is not
# /home/<name>.
podman_data_dir: "{{ ansible_facts['user_dir'] }}/podman-data"
quadlet_dir: "{{ ansible_facts['user_dir'] }}/.config/containers/systemd"

# Rootless containers cannot publish ports below 1024 without this sysctl.
# Caddy needs 80/443, so patching it down to 80 is the standard trade.
podman_unprivileged_port_start: 80

# ---------------------------------------------------------------------------
# Caddy
# ---------------------------------------------------------------------------
caddy_name: caddy
caddy_unit: "{{ caddy_name }}.service"

# Fully qualified on purpose: rootless Podman resolves short names against
# unqualified-search-registries, and there is no TTY to answer a prompt when
# the systemd unit starts.
caddy_image: docker.io/library/caddy:latest

host_directory: "{{ podman_data_dir }}/caddy"
caddyfile_path: "{{ host_directory }}/conf/Caddyfile"

# Quadlet drop-in directory for the Caddy unit. Services register themselves
# here; see the "How services register themselves" section of readme.md.
# Caddy itself never lists its upstream networks.
caddy_dropin_dir: "{{ quadlet_dir }}/{{ caddy_name }}.container.d"

# Host ports. 443/udp is HTTP/3 (QUIC).
caddy_ports:
  - "80:80"
  - "443:443"
  - "443:443/udp"