---
# Duplicated from caddy/vars/default.yml on purpose, so keep them in sync.
# podman_user comes from the connection user, so the play needs gather_facts.
podman_user: "{{ ansible_facts['user_id'] }}"
podman_data_dir: "{{ ansible_facts['user_dir'] }}/podman-data"
quadlet_dir: "{{ ansible_facts['user_dir'] }}/.config/containers/systemd"

host: git.tanshu.com

container_name: gitea
unit_name: "{{ container_name }}.service"

# Fully qualified because rootless Podman would otherwise prompt for a registry, and a unit has no TTY.
image: docker.io/gitea/gitea:latest

# caddy/roles/register pins the Podman network to <network_name>_net, so the Quadlet file is gitea.network.
network_name: "{{ container_name }}"

host_directory: "{{ podman_data_dir }}/{{ container_name }}"

# The port Caddy proxies to inside the container, where app.ini's HTTP_PORT listens. Nothing is published on the host.
container_port: 3000

# The uid/gid of the image's `git` account, and therefore the uid Gitea runs as.
# UserNS maps it onto podman_user, USER_UID/GID keep it, and roles/ssh execs as it, so change all three together.
gitea_uid: 1003
gitea_gid: 1003

# The image's data directory inside the container, and the GITEA_CUSTOM it already sets.
gitea_custom: /data/gitea

# The image ships no HEALTHCHECK, so the unit defines one from this endpoint and the play gates on it.
health_cmd: "curl -fsS -o /dev/null http://127.0.0.1:{{ container_port }}/api/healthz"

# Only log timestamps are affected: Gitea stores each user's own timezone.
timezone: Asia/Kolkata

# The in-image sshd needs host keys somewhere, but it runs as a subuid, so keep them outside the data tree.
container_sshd_hostkeys: "{{ podman_data_dir }}/{{ container_name }}-sshd"

# Clients keep using git@git.tanshu.com:user/repo.git on port 22, served by the host's sshd.
# `git_home` only has to exist, and its uid is left to the system.
git_user: git
git_home: /home/git

# Renaming this path locks users out because every authorized_keys line Gitea writes already contains it.
shim_path: /usr/local/bin/gitea

# Runs as podman_user through the sudoers drop-in and does the podman exec.
podman_exec_wrapper: /usr/local/bin/gitea-container-exec

authorized_keys_command: /usr/local/bin/gitea-authorized-keys

sshd_dropin_path: /etc/ssh/sshd_config.d/60-gitea.conf
sshd_service: ssh
sudoers_path: /etc/sudoers.d/gitea-ssh-passthrough

caddy_name: caddy
caddyfile_path: "{{ podman_data_dir }}/{{ caddy_name }}/conf/Caddyfile"

snippet_block: |
  {{ host }} {
      reverse_proxy {{ container_name }}:{{ container_port }}
  }