---
# A play cannot include caddy/vars/default.yml, which also sets host_directory,
# so keep these in sync with it. Set gather_facts: true for the facts below.
podman_user: "{{ ansible_facts['user_id'] }}"
podman_data_dir: "{{ ansible_facts['user_dir'] }}/podman-data"
quadlet_dir: "{{ ansible_facts['user_dir'] }}/.config/containers/systemd"

postgres_container: postgres
postgres_unit: "{{ postgres_container }}.service"

# 18 is deliberate: monoco runs 17.5 and a PGDATA copy cannot cross a major
# version, so the data moves with a logical dump. The alpine tag still floats
# within 18.x for security patches.
postgres_major: '18'

# Fully qualified, because short names prompt for a registry and the unit has
# no TTY.
postgres_image: "docker.io/library/postgres:{{ postgres_major }}-alpine"

# The image's postgres account is uid and gid 70. keep-id maps it onto
# podman_user, so PGDATA and backups stay owned by the host user.
postgres_uid: 70
postgres_gid: 70

host_directory: "{{ podman_data_dir }}/{{ postgres_container }}"

# Postgres 18 moved PGDATA under <major>/docker, and its entrypoint refuses a
# cluster in the old layout. The versioned path also keeps pg_upgrade --link on
# one filesystem.
postgres_mount: /var/lib/postgresql

# One value keeps the container and host paths from drifting apart.
postgres_versioned_subdir: "{{ postgres_major }}/docker"

pgdata: "{{ postgres_mount }}/{{ postgres_versioned_subdir }}"
pgdata_host_dir: "{{ host_directory }}/{{ postgres_versioned_subdir }}"

# The unit file is world-readable, so secrets go in a 0600 EnvironmentFile=.
postgres_env_file: "{{ host_directory }}/postgres.env"

postgres_dropin_dir: "{{ quadlet_dir }}/{{ postgres_container }}.container.d"

# Placeholder password. Replace with a real secret.
pg_user: postgres
pg_password: '123456'
pg_database: postgres

# First start runs initdb, and a database needs time to stop cleanly.
postgres_timeout_start: 120
postgres_timeout_stop: 60