---
# Duplicated from caddy/vars/default.yml, so keep them in sync.
podman_user: "{{ ansible_facts['user_id'] }}"
podman_data_dir: "{{ ansible_facts['user_dir'] }}/podman-data"
quadlet_dir: "{{ ansible_facts['user_dir'] }}/.config/containers/systemd"

# What Caddy serves, and the trusted domain for an unattended install.
host: cloud.hopsngrains.com

container_name: nextcloud
unit_name: "{{ container_name }}.service"

# Fully qualified because rootless Podman would otherwise prompt for a registry, and a unit has no TTY.
image: docker.io/library/nextcloud:latest

# caddy/roles/register pins the Podman network to <network_name>_net, so the Quadlet file is nextcloud.network.
network_name: "{{ container_name }}"

# The image's VOLUME and Apache docroot, and unlike other services it holds the code as well as the state.
host_directory: "{{ podman_data_dir }}/{{ container_name }}"
webroot: /var/www/html

# www-data. The entrypoint rsyncs the code in as this uid, and Apache workers run as it.
app_uid: 33
app_gid: 33

# Apache's port inside the container, and the one Caddy proxies to.
container_port: 80

env_file: "{{ host_directory }}/nextcloud.env"

postgres_container: postgres
postgres_unit: "{{ postgres_container }}.service"
db_host: db

# The database this play creates, and the credentials the cluster was initialised with.
pg_user: postgres
pg_password: '123456'
pg_database: nextcloud

# Valkey's attach role adds the `redis` alias, which config.php uses for cache and locking.
valkey_container: valkey
valkey_unit: "{{ valkey_container }}.service"

caddy_name: caddy
caddyfile_path: "{{ podman_data_dir }}/{{ caddy_name }}/conf/Caddyfile"

# Empty keeps the setup wizard. Set both to install unattended, with trusted_domains from `host`.
nextcloud_admin_user: ""
nextcloud_admin_password: ""

cron_minute: "*/5"

snippet_block: |
  {{ host }} {
      reverse_proxy {{ container_name }}:{{ container_port }}

      header {
          Strict-Transport-Security "max-age=15552000; includeSubDomains; preload"
      }
  }