---
# ---------------------------------------------------------------------------
# Rootless Podman / Quadlet
# ---------------------------------------------------------------------------
# Duplicated on purpose from caddy/vars/default.yml: a play cannot include that
# file wholesale, because it also sets `host_directory` — to the Caddy data
# directory — and every playbook defines that for itself. Keep these three in
# sync with caddy/vars/default.yml. (Its fourth, podman_unprivileged_port_start,
# belongs to the podman tasks, which this play does not run: Valkey publishes
# nothing host-side.)
#
# podman_user is derived from the connection: this play carries no become, so
# the Quadlet units belong to whoever Ansible connects as. Requires gather_facts
# (set in playbook.yml).
podman_user: "{{ ansible_facts['user_id'] }}"
podman_data_dir: "{{ ansible_facts['user_dir'] }}/podman-data"
quadlet_dir: "{{ ansible_facts['user_dir'] }}/.config/containers/systemd"

# ---------------------------------------------------------------------------
# Valkey
# ---------------------------------------------------------------------------
container_name: valkey
unit_name: "{{ container_name }}.service"

# Fully qualified on purpose: rootless Podman resolves short names against
# unqualified-search-registries, and there is no TTY to answer a prompt when the
# systemd unit starts. The Docker-era playbook said `valkey/valkey:alpine`.
image: docker.io/valkey/valkey:alpine

host_directory: "{{ podman_data_dir }}/{{ container_name }}"

# The image's WORKDIR and VOLUME: the RDB snapshot and, if it is ever enabled,
# the AOF live here. The contents are disposable — nothing needs to be copied
# off monoco — but the mount is not: RDB persistence is on by default, and the
# graceful stop of a rebuild writes a final snapshot here that the next
# container loads. Keep it unless you also set `save ""`. See readme.md, "The
# trade-off".
data_mount: /data

# The uid and gid of the image's `valkey` account. The uid is 999 — the one the
# anonymous Docker volume was owned by (docs/podman-compat-audit.md §3.2) — but
# the gid is *1000*, not 999: Alpine already has a gid 999, and the image's
# Dockerfile says so outright ("alpine already has a gid 999, so we'll use the
# next id") before dropping to the account with `setpriv --regid=valkey`.
# Mapping both ids onto podman_user is what keeps {{ host_directory }} — owner
# and group alike — with the connection user, instead of stranding the group on
# a subgid the moment valkey-server writes a snapshot.
app_uid: 999
app_gid: 1000

# No PublishPort, on purpose: the Docker-era playbook published 127.0.0.1:6379,
# and nothing on the host needs it. Clients reach Valkey over the app networks
# that attach themselves; {{ container_port }} is the port inside the container.
container_port: 6379

# Quadlet drop-in directory for the Valkey unit. Services attach themselves
# here; see the "How services attach themselves" section of readme.md.
valkey_dropin_dir: "{{ quadlet_dir }}/{{ container_name }}.container.d"