---
# Derived from the connection user; requires gather_facts.
podman_user: "{{ ansible_facts['user_id'] }}"
podman_data_dir: "{{ ansible_facts['user_dir'] }}/podman-data"
quadlet_dir: "{{ ansible_facts['user_dir'] }}/.config/containers/systemd"

host: track.tanshu.com

container_name: yamtrack
unit_name: "{{ container_name }}.service"

# Fully qualified so rootless Podman never prompts for a short name; there is no TTY.
image: ghcr.io/fuzzygrim/yamtrack:latest

# The Quadlet file is <network_name>.network; register pins <network_name>_net.
network_name: "{{ container_name }}"

host_directory: "{{ podman_data_dir }}/{{ container_name }}"

# /yamtrack/db holds db.sqlite3 and its WAL sidecars; nothing else on /yamtrack is state.
data_dir: "{{ host_directory }}/data"

# The image's nginx listens on 8000 and forwards to gunicorn.
container_port: 8000

# The unit is world-readable, so secrets go in this 0600 file.
env_file: "{{ host_directory }}/{{ container_name }}.env"

# It is 0 because the entrypoint rewrites /etc/group and /etc/passwd as container root.
# keep-id:uid=1000 would run that as abc and exit before supervisord starts.
# Mapping root onto podman_user keeps the data owned by podman_user, not a subuid.
app_uid: 0
app_gid: 0

yamtrack_tz: "Asia/Kolkata"

# Carried over so existing sessions and password-reset tokens stay valid.
yamtrack_secret: "c14c5970eb728fbf8b2325fd3004069d"

# ALLOWED_HOSTS is deliberately unset; its default is *.
urls: "https://{{ host }}"

# The container is called valkey, so the Redis URL is unchanged.
valkey_container: valkey
valkey_unit: "{{ valkey_container }}.service"
redis_url: "redis://{{ valkey_container }}:6379"

caddy_name: caddy
caddyfile_path: "{{ podman_data_dir }}/{{ caddy_name }}/conf/Caddyfile"

snippet_block: |
  {{ host }} {
      reverse_proxy {{ container_name }}:{{ container_port }}
  }