---
server_username: "{{ username }}"
server_user_group: "{{ server_username }}"
server_user_home: "/home/{{ server_username }}"
effective_username: "{{ server_username }}"
effective_user_group: "{{ server_user_group }}"
effective_user_home: "{{ server_user_home }}"
server_container_stack_dir: /opt/docker/server
ai_agents: {}
vim_plugins_enabled: false

profile_packages:
  - avahi-daemon
  - dmidecode
  - dosfstools
  - gh
  - gnupg
  - gpg-agent
  - netcat-openbsd
  - openssh-server
  - parted
  - pciutils
  - pinentry-curses
  - ranger
  - rsync

server_dotfiles:
  - src: .bashrc.d/20-editor-server.sh
    dest: .bashrc.d/20-editor-server.sh
    mode: "0644"
  - src: .gnupg/gpg-agent.conf
    dest: .gnupg/gpg-agent.conf
    mode: "0600"
  - src: .gitignore_global
    dest: .gitignore_global
    mode: "0644"
  - src: .themes.gitignore
    dest: .themes.gitignore
    mode: "0644"

server_templates:
  - src: server/.gitconfig.j2
    dest: .gitconfig
    mode: "0644"
  - src: server/docker-compose.yml.j2
    dest: "{{ server_container_stack_dir }}/docker-compose.yml"
    owner: root
    group: root
    mode: "0600"
    no_log: true

server_directories:
  - path: "{{ server_user_home }}/.bashrc.d"
    owner: "{{ server_username }}"
    group: "{{ server_user_group }}"
    mode: "0755"
  - path: "{{ server_user_home }}/.gnupg"
    owner: "{{ server_username }}"
    group: "{{ server_user_group }}"
    mode: "0700"
  - path: "{{ server_container_stack_dir }}"
    owner: root
    group: root
    mode: "0755"
  - path: /opt/npm/data
    owner: root
    group: root
    mode: "0755"
  - path: /opt/npm/letsencrypt
    owner: root
    group: root
    mode: "0755"
  - path: /opt/gitea/data
    owner: root
    group: root
    mode: "0755"

server_sshd_settings:
  PermitRootLogin: "no"

server_sshd_allow_users:
  - "{{ server_username }}"
server_backup_export_enabled: false
server_backup_username: prometheus-backup
server_backup_public_key_name: atlas-pull
server_backup_export_root: /var/lib/prometheus-backup-export
server_backup_rrsync_path: /usr/share/doc/rsync/support/rrsync
server_backup_export_calendar: "*-*-* 02:00:00 Europe/Rome"
server_backup_export_start_timer: false
# Explicit Gitea cutover helper: installed separately from any outage action.
server_gitea_cutover_tools_enabled: false
server_gitea_final_export: false
server_gitea_on_atlas: false
server_gitea_atlas_address: "{{ hostvars['atlas'].ansible_host }}"
server_gitea_npm_domains: []
server_gitea_ssh_public_port: 2222
server_gitea_ssh_target_port: 2222
server_backup_export_source_keep: 3
server_backup_export_paths: >-
  {{ ['opt/npm/data', 'opt/npm/letsencrypt']
     + ([] if server_gitea_on_atlas | bool else ['opt/gitea/data', 'home/git/.ssh'])
     + ['opt/docker/server/docker-compose.yml',
        'etc/systemd/system/podman-compose-server.service',
        'etc/ssh/sshd_config', 'etc/ssh/sshd_config.d',
        'etc/firewalld', 'etc/wireguard/wg0.conf'] }}
server_backup_export_excludes: >-
  {{ ['opt/npm/data/logs']
     + ([] if server_gitea_on_atlas | bool else
        ['opt/gitea/data/gitea/log', 'opt/gitea/data/gitea/tmp',
         'opt/gitea/data/gitea/sessions', 'opt/gitea/data/gitea/indexers']) }}
server_ssh_authorized_keys: []
server_ssh_authorized_key_directory: "{{ server_user_home }}/.ssh/authorized_keys.d"