---
# ---------------------------------------------------------------------------
# Rootless Podman / Quadlet
# ---------------------------------------------------------------------------
# Duplicated on purpose from caddy/vars/default.yml: a play cannot include that
# file wholesale, because it also sets `host_directory` — to the Caddy data
# directory — and every playbook defines that for itself. Keep these three in
# sync with caddy/vars/default.yml. (Its fourth, podman_unprivileged_port_start,
# belongs to the podman tasks, which this play does not run: Wiki.js publishes
# nothing host-side.)
#
# podman_user is derived from the connection: this play carries no become, so
# the Quadlet units belong to whoever Ansible connects as. Requires gather_facts
# (set in playbook.yml).
podman_user: "{{ ansible_facts['user_id'] }}"
podman_data_dir: "{{ ansible_facts['user_dir'] }}/podman-data"
quadlet_dir: "{{ ansible_facts['user_dir'] }}/.config/containers/systemd"

# ---------------------------------------------------------------------------
# Wiki.js
# ---------------------------------------------------------------------------
# The service keeps the Docker-era name everywhere — container, unit, Podman
# network and Postgres database are all `hiwikijs`, and the Caddyfile upstream is
# `hiwikijs:3000`. Only the directory is `wikijs`, because that is the playbook's
# name. Renaming the container would touch the Caddyfile, the network name and
# the database for no gain.
host: wiki.hinchco.in

container_name: hiwikijs
unit_name: "{{ container_name }}.service"

# Fully qualified on purpose: registry + org + repo, so rootless Podman never
# consults unqualified-search-registries. There is no TTY to answer a short-name
# prompt when the systemd unit starts.
image: ghcr.io/requarks/wiki:latest

# The Quadlet file is <network_name>.network. caddy/roles/register pins the
# Podman network name to <network_name>_net (so: hiwikijs.network,
# hiwikijs_net — the name the Docker-era container used).
network_name: "{{ container_name }}"

host_directory: "{{ podman_data_dir }}/{{ container_name }}"

# The uid the app actually runs as: the image's `USER node`, and `node` is uid
# 1000 there (verified: `docker exec hiwikijs id` → uid=1000(node) gid=1000).
# keep-id maps that uid onto podman_user, so anything written into the mounts
# below stays owned by podman_user on the host and never by a subuid.
#
# Note this is *not* root: unlike bitwarden and tandoor (uid 0), Wiki.js runs
# unprivileged, so the mapping goes through 1000. `tanshu` is uid 1001 — "the
# data is already mine" is false, which is the trap in
# docs/podman-migration.md §4.1.
wikijs_uid: 1000
wikijs_gid: 1000

# The image declares VOLUME /wiki/data/content. On Docker that silently became an
# *anonymous* volume under /var/lib/docker/volumes, which is why nothing under
# /var/lib ever held the wiki and why the old backup script archived an empty
# directory (docs/podman-compat-audit.md §3.1). Binding it to a real path is the
# fix. It is empty on monoco today — see readme.md.
content_dir: "{{ host_directory }}/content"

# Not a declared volume, but it is where Wiki.js's default "Local File System"
# storage target writes uploads. Empty on monoco today — the wiki's 49 uploaded
# assets are rows in Postgres (`assetData`, 5.8 MB of the 16 MB database) — so
# this is insurance: if the storage target is ever switched to local files, the
# bytes land in a directory that gets backed up instead of in the container's
# writable layer, where nothing would ever find them.
uploads_dir: "{{ host_directory }}/uploads"

# DB_PASS carries the Postgres password and the Quadlet unit is world-readable in
# ~/.config, so it goes in this 0600 file instead and is read by systemd through
# EnvironmentFile=.
env_file: "{{ host_directory }}/{{ container_name }}.env"

# From the image's own config.yml (`port: 3000`, `bindIP: 0.0.0.0`). Caddy
# proxies to it over the app network; nothing is published host-side.
container_port: 3000

# The shared Postgres unit this app attaches itself to (postgres/playbook.yml).
# roles/postgres owns this app's drop-ins there and the "Restart Postgres"
# handler that applies them.
postgres_container: postgres
postgres_unit: "{{ postgres_container }}.service"

# The credentials the Docker-era playbook embedded in its .env file, kept as-is
# so the already-restored `hiwikijs` database and the app's own connection string
# agree. Postgres is authoritative for this service; nothing here is new.
pg_user: postgres
pg_password: '123456'
pg_database: hiwikijs

# `db`, not `postgres`: that is literally what the Docker-era container ran with
# (it was `--link postgres:db`), and postgres/roles/attach writes the shared
# NetworkAlias=db drop-in that makes it resolve on hiwikijs_net. The container
# name resolves too, and the play checks both.
db_host: db

# The shared Caddy unit and its Caddyfile, both owned by caddy/playbook.yml.
caddy_name: caddy
caddyfile_path: "{{ podman_data_dir }}/{{ caddy_name }}/conf/Caddyfile"

snippet_block: |
  {{ host }} {
      reverse_proxy {{ container_name }}:{{ container_port }}
  }