---
# Duplicated from caddy/vars/default.yml on purpose, so keep them in sync.
# podman_user comes from the connection user, so the play needs gather_facts.
podman_user: "{{ ansible_facts['user_id'] }}"
podman_data_dir: "{{ ansible_facts['user_dir'] }}/podman-data"
quadlet_dir: "{{ ansible_facts['user_dir'] }}/.config/containers/systemd"

# The service keeps the Docker-era name everywhere. Only the image is vaultwarden/server.
host: vault.tanshu.com

container_name: bitwarden
unit_name: "{{ container_name }}.service"

# Fully qualified because rootless Podman would otherwise prompt for a registry, and a unit has no TTY.
image: docker.io/vaultwarden/server:latest

# caddy/roles/register pins the Podman network to <network_name>_net, so the Quadlet file is bitwarden.network.
network_name: "{{ container_name }}"

host_directory: "{{ podman_data_dir }}/{{ container_name }}"

# The image's VOLUME is /data and ROCKET_PORT is 80, so this is the bind mount target and the proxied port.
data_dir: "{{ host_directory }}/data"
container_port: 80

# DATABASE_URL carries the Postgres password, so keep it in this 0600 file that systemd reads.
env_file: "{{ host_directory }}/bitwarden.env"

postgres_container: postgres
postgres_unit: "{{ postgres_container }}.service"

# Kept as-is so the restored database and the app's connection string agree.
pg_user: postgres
pg_password: '123456'
pg_database: bitwarden

# A hostname, not an IP: postgres/roles/attach joins the container to bitwarden_net, which makes it resolve.
database_url: "postgresql://{{ pg_user }}:{{ pg_password }}@{{ postgres_container }}:5432/{{ pg_database }}"

# Vaultwarden requires a scheme here and builds its web vault and API links from it.
domain: "https://{{ host }}"

caddy_name: caddy
caddyfile_path: "{{ podman_data_dir }}/{{ caddy_name }}/conf/Caddyfile"

# Caddy streams request bodies with no limit by default, so there is no client_max_body_size equivalent.
snippet_block: |
  {{ host }} {
      reverse_proxy {{ container_name }}:{{ container_port }}
  }