---
# ============================================================================
# semaphore role defaults
# ============================================================================
# Deploys SemaphoreUI (https://semaphoreui.com) as a rootful Podman service
# managed via Quadlet. Uses a separate PostgreSQL 16 container on the same
# user-defined network. Both services persist to named volumes.
#
# Admin user creation is intentionally NOT automated — the Semaphore CLI's
# `user add` command has been unreliable across versions. Operator creates
# the first admin manually after the first successful deployment; see README.
# ============================================================================

# ---------------------------------------------------------------------------
# Image pinning
# ---------------------------------------------------------------------------
# The -ansible2.16.5 tag bundles Ansible 2.16.5 inside the Semaphore image,
# which matches the controller. Useful when Semaphore itself runs playbooks.
semaphore_image: "docker.io/semaphoreui/semaphore:v2.18.5-ansible2.16.5"
semaphore_postgres_image: "docker.io/library/postgres:16-alpine"

# ---------------------------------------------------------------------------
# Container & network identifiers
# ---------------------------------------------------------------------------
semaphore_container_name: semaphore
semaphore_postgres_container_name: semaphore-postgres
semaphore_network_name: semaphore-net

# Named podman volumes
semaphore_data_volume: semaphore_data
semaphore_postgres_volume: semaphore_postgres_data

# ---------------------------------------------------------------------------
# Networking
# ---------------------------------------------------------------------------
# Port exposed on the VM. Traefik on lightning-lane terminates TLS and
# forwards to this port. Localhost-bind keeps the raw service off the LAN.
semaphore_listen_address: "0.0.0.0"
semaphore_listen_port: 3000

# Public URL used for Semaphore-generated absolute URLs (webhooks, OIDC
# callbacks, etc). Leave EMPTY to make Semaphore host-agnostic — the SPA
# then uses relative URLs and serves cleanly under any hostname Traefik
# points at it. Set to a fully-qualified URL only if a specific feature
# requires an absolute base.
semaphore_web_url: ""

# ---------------------------------------------------------------------------
# PostgreSQL configuration
# ---------------------------------------------------------------------------
semaphore_db_user: semaphore
semaphore_db_name: semaphore
# semaphore_db_password sourced from vault below

# ---------------------------------------------------------------------------
# Vault inputs (defined in group_vars/all/vault, encrypted with ansible-vault)
# ---------------------------------------------------------------------------
# vault_semaphore_database_password      - postgres role password
# vault_semaphore_admin_password         - initial admin password (used only
#                                          during manual user-add step)
# vault_semaphore_access_key_encryption  - 32-byte key for encrypting
#                                          Semaphore-stored access keys
semaphore_db_password: "{{ vault_semaphore_database_password }}"
semaphore_admin_password: "{{ vault_semaphore_admin_password }}"
semaphore_access_key_encryption: "{{ vault_semaphore_access_key_encryption }}"

# ---------------------------------------------------------------------------
# Health check
# ---------------------------------------------------------------------------
semaphore_health_check_retries: 30
semaphore_health_check_delay: 2

# ---------------------------------------------------------------------------
# Quadlet location (rootful)
# ---------------------------------------------------------------------------
semaphore_quadlet_dir: /etc/containers/systemd

# ---------------------------------------------------------------------------
# Ansible collections
# ---------------------------------------------------------------------------
# Host-side directory bind-mounted into the container at
# /home/semaphore/.ansible/collections so collections persist across
# container restarts and rebuilds.
semaphore_collections_dir: /opt/semaphore/ansible-collections

# UID of the semaphore user inside the container (uid=1001).
# The host-side collections directory must be owned by this UID so the
# container process can write collections into the bind-mount.
semaphore_container_uid: 1001

semaphore_ansible_collections:
  - name: containers.podman
    version: ">=1.10.0"
  - name: effectivelywild.technitium_dns
    version: ">=1.1.0"