multica deployment

ansible/roles/multica_docker/defaults/main.yml

@@ -0,0 +1,65 @@
+---
+# ───────────────────────── Multica ─────────────────────────
+multica_install_dir: /opt/multica
+multica_repo_url: https://github.com/multica-ai/multica.git
+# Git ref for the compose file / .env.example. Pin to a release tag for reproducible deploys.
+multica_version: main
+multica_git_update: true
+# Image tag for backend + frontend (written to MULTICA_IMAGE_TAG). Keep in step with multica_version when pinning.
+multica_image_tag: latest
+multica_compose_project: multica
+# true = `docker compose pull` every run (needed to move a floating `latest` tag forward)
+multica_pull_latest: false
+# Sets DO_NOT_TRACK=true on the backend (disables first-party anonymous telemetry)
+multica_disable_telemetry: false
+
+# Secrets (supply via ansible-vault). Role fails fast if empty.
+multica_jwt_secret: "{{ vault_multica_jwt_secret | default('') }}"
+multica_postgres_password: "{{ vault_multica_postgres_password | default('') }}"
+multica_vcs_secret_key: "{{ vault_multica_vcs_secret_key | default('') }}"
+# Optional: enables emailed verification codes instead of reading them from backend logs
+multica_resend_api_key: "{{ vault_multica_resend_api_key | default('') }}"
+
+# Any extra .env keys, e.g. { ALLOW_SIGNUP: "false", GOOGLE_CLIENT_ID: "..." }
+multica_extra_env: {}
+
+# Postgres identity used by the optional backup task (match your .env if changed)
+multica_postgres_user: multica
+multica_postgres_db: multica
+# Take a pg_dump before changing a running stack. Recommended before upgrades:  -e multica_backup_enabled=true
+multica_backup_enabled: false
+multica_backup_dir: /var/backups/multica
+
+# Hide secret-bearing task output
+multica_no_log: true
+
+# ───────────────────────── Routing ─────────────────────────
+# single: one hostname (multica_domain)
+# split : two hostnames (multica_app_domain + multica_api_domain)
+multica_layout: single
+multica_domain: ""
+multica_app_domain: ""
+multica_api_domain: ""
+
+# ───────────────────────── Caddy ─────────────────────────
+caddy_install_dir: /opt/caddy
+caddy_container_name: caddy
+# Caddy image tag. "2" tracks latest 2.x
+caddy_version: "2"
+
+# acme_http      – automatic HTTPS via HTTP-01/TLS-ALPN-01 (needs public 80/443)
+# cloudflare_dns – DNS-01 via Cloudflare; builds a custom Caddy image with the caddy-dns/cloudflare module
+# internal       – Caddy's internal CA (LAN only; clients must trust Caddy's root cert)
+caddy_tls_mode: acme_http
+caddy_acme_email: ""
+caddy_cloudflare_api_token: "{{ vault_cloudflare_api_token | default('') }}"
+# Rebuild the custom image on every run (cloudflare_dns only)
+caddy_force_rebuild: false
+
+# Caddy runs with host networking so it can reach Multica's 127.0.0.1-bound ports.
+# Change these if 80/443 are already taken on the host (e.g. nginx).
+caddy_http_port: 80
+caddy_https_port: 443
+
+# Post-deploy checks through the public hostname(s). Needs DNS to resolve from the target host.
+multica_verify_public: true