---
# Paperclip Official image
paperclip_image: ghcr.io/paperclipai/paperclip
paperclip_version: "2026.1001.0"   # no "v" prefix; also accepts stable, beta, nightly, canary, sha-<short>

# Paperclip deployment paths and configuration
paperclip_base_path: /opt/paperclip
paperclip_data_dir: "{{ paperclip_base_path }}/data"
paperclip_port: 3100
paperclip_domain: cranium-command.wdw-labs.cloud
paperclip_host: cranium-command.wdw-labs.cloud
# paperclip_listen_host: 127.0.0.1 # Bootstrap local deployment
paperclip_listen_host: 0.0.0.0 # Switch to this host after CEO is functional on local model

# Paperclip allowed hostnames (space or comma-separated)
# Includes: domain name, localhost (for internal/local access), and client IP
paperclip_allowed_hostnames: "{{ paperclip_domain }} localhost 192.168.10.50"

# Deployment mode: authenticated (requires login) or local_trusted (no auth, trusted network)
# paperclip_deployment_mode: "local_trusted" # Bootstrap local deployment
paperclip_deployment_mode: "authenticated" # Switch to this model after CEO is functional on local model

# TLS / reverse proxy are handled by the nginx-proxy role (/opt/nginx).
# Set nginx_proxy_certbot_email in host_vars; run day1_deploy_nginx_proxy.yml first.

# Inference endpoints (vLLM or remote OpenAI-compatible)
illuminations_endpoint: "http://illuminations:8000"
fantasmic_endpoint: "http://fantasmic.wdw-labs.cloud:8000"
wishes_endpoint: "http://wishes.wdw-labs.cloud:8000"

# NOTE: Secrets come from the ansible vault and are written to .env (mode 0600):
#   vault_better_auth_secret, vault_paperclip_agent_jwt_secret,
#   vault_illuminations_api_key, vault_fantasmic_api_key
# Everything in .env is passed into the Paperclip container (env_file), so only
# put values here that Paperclip itself should be able to read.