---
all:
    vars:
        cs_cluster_name: "blr-home"
        cs_project_code: "{{ lookup('ansible.builtin.env', 'CS_PROJECT_CODE',
            errors='strict', default=undef())
            | ansible.builtin.mandatory(msg='CS_PROJECT_CODE environment variable is not set.') }}"
        __cs_secrets_path_prefix: "{{ cs_project_code }}/application-deployer/clusters"
    children:
        patchservers:
            hosts:
                rb5-m3:
                s1-home:
                sash-m1:
                s1-dev:
        minio_community:
            hosts:
                s1-home:
        restic:
            hosts:
                s1-dev:
        postgres:
            hosts:
                s1-home:
        wireguard:
            hosts:
                rb5-m3:
        reverse_proxy:
            hosts:
                rb5-m3:
        nextcloud:
            hosts:
                s1-home:
        jellyfin:
            hosts:
                s1-dev:
        navidrome:
            hosts:
                s1-dev:
        vikunja:
            hosts:
                s1-home:
        samba:
            hosts:
                s1-home:
                s1-dev:
        qbittorrent_nox:
            hosts:
                s1-home:
        emby:
            hosts:
                s1-dev:
        code_server:
            hosts:
                s1-dev:
    hosts:
        rb5-m3:
            cs_rp_restic_node_name: s1-dev
            cs_rp_hosts:
                code-server-public:
                    allow_websocket_upgrade: true
                    domains:
                        - code-server-{{ __cs_cluster_domain }}
                    forward_host: "{{ lookup('vault_kv_get',
                        __cs_secrets_path_prefix + '/' + cs_cluster_name + '/hosts/s1-dev')['host'] }}"
                    forward_port: "{{ lookup('vault_kv_get',
                        __cs_secrets_path_prefix + '/' + cs_cluster_name + '/hosts/s1-dev'
                        + '/apps/code-server/config')['web-gui-port'] }}"
                    forward_scheme: http
                    mtls_outbound: false
                emby-public:
                    allow_websocket_upgrade: true
                    domains:
                        - emby-{{ __cs_cluster_domain }}
                    forward_host: "{{ lookup('vault_kv_get',
                        __cs_secrets_path_prefix + '/' + cs_cluster_name + '/hosts/s1-dev')['host'] }}"
                    forward_port: "{{ lookup('vault_kv_get',
                        __cs_secrets_path_prefix + '/' + cs_cluster_name + '/hosts/s1-dev'
                        + '/apps/emby/config')['internal_https_port'] }}"
                    forward_scheme: https
                    mtls_outbound: false
                jellyfin-public:
                    allow_websocket_upgrade: true
                    domains:
                        - jellyfin-{{ __cs_cluster_domain }}
                    forward_host: "{{ lookup('vault_kv_get',
                        __cs_secrets_path_prefix + '/' + cs_cluster_name + '/hosts/s1-dev')['host'] }}"
                    forward_port: "{{ lookup('vault_kv_get',
                        __cs_secrets_path_prefix + '/' + cs_cluster_name + '/hosts/s1-dev'
                        + '/apps/jellyfin/config')['internal_https_port'] }}"
                    forward_scheme: https
                    mtls_outbound: false
                minio-console-public:
                    allow_websocket_upgrade: true
                    domains:
                        - minio-console-{{ __cs_cluster_domain }}
                    forward_host: "{{ lookup('vault_kv_get',
                        __cs_secrets_path_prefix + '/' + cs_cluster_name + '/hosts/s1-home')['host'] }}"
                    forward_port: "{{ lookup('vault_kv_get',
                        __cs_secrets_path_prefix + '/' + cs_cluster_name + '/hosts/s1-home'
                        + '/apps/minio-s3/config')['console_port'] }}"
                    forward_scheme: https
                    mtls_outbound: false
                minio-s3-public:
                    allow_websocket_upgrade: true
                    domains:
                        - minio-s3-{{ __cs_cluster_domain }}
                    forward_host: "{{ lookup('vault_kv_get',
                        __cs_secrets_path_prefix + '/' + cs_cluster_name + '/hosts/s1-home')['host'] }}"
                    forward_port: "{{ lookup('vault_kv_get',
                        __cs_secrets_path_prefix + '/' + cs_cluster_name + '/hosts/s1-home'
                        + '/apps/minio-s3/config')['port'] }}"
                    forward_scheme: https
                    mtls_outbound: false
                navidrome-public:
                    allow_websocket_upgrade: true
                    domains:
                        - navidrome-{{ __cs_cluster_domain }}
                    forward_host: "{{ lookup('vault_kv_get',
                        __cs_secrets_path_prefix + '/' + cs_cluster_name + '/hosts/s1-dev')['host'] }}"
                    forward_port: "{{ lookup('vault_kv_get',
                        __cs_secrets_path_prefix + '/' + cs_cluster_name + '/hosts/s1-dev'
                        + '/apps/navidrome/config')['port'] }}"
                    forward_scheme: http
                    mtls_outbound: false
                nextcloud-public:
                    allow_websocket_upgrade: true
                    domains:
                        - nextcloud-{{ __cs_cluster_domain }}
                    forward_host: "{{ lookup('vault_kv_get',
                        __cs_secrets_path_prefix + '/' + cs_cluster_name + '/hosts/s1-home')['host'] }}"
                    forward_port: "{{ lookup('vault_kv_get',
                        __cs_secrets_path_prefix + '/' + cs_cluster_name + '/hosts/s1-home'
                        + '/apps/nextcloud/config')['apache_port'] }}"
                    forward_scheme: https
                    mtls_outbound: false
                qbittorrent-nox-public:
                    allow_websocket_upgrade: true
                    domains:
                        - qbittorrent-nox-{{ __cs_cluster_domain }}
                        - qbn-{{ __cs_cluster_domain }}
                    forward_host: "{{ lookup('vault_kv_get',
                        __cs_secrets_path_prefix + '/' + cs_cluster_name + '/hosts/s1-home')['host'] }}"
                    forward_port: "{{ lookup('vault_kv_get',
                        __cs_secrets_path_prefix + '/' + cs_cluster_name + '/hosts/s1-home'
                        + '/apps/qbittorrent-nox/config')['https_port'] }}"
                    forward_scheme: https
                    mtls_outbound: false
                vikunja-public:
                    allow_websocket_upgrade: true
                    domains:
                        - vikunja-{{ __cs_cluster_domain }}
                    forward_host: "{{ lookup('vault_kv_get',
                        __cs_secrets_path_prefix + '/' + cs_cluster_name + '/hosts/s1-home')['host'] }}"
                    forward_port: "{{ lookup('vault_kv_get',
                        __cs_secrets_path_prefix + '/' + cs_cluster_name + '/hosts/s1-home'
                        + '/apps/vikunja/config')['port'] }}"
                    forward_scheme: http
                    mtls_outbound: false
                    # Vikunja's install task recreates its container on every deploy, causing a
                    # brief connection-refused window. NPM's asset-caching location caches any
                    # response code (including that transient error) for 30 minutes and ignores
                    # Vikunja's own cache headers, so a deploy can poison static assets with a
                    # cached error. Vikunja already sends strong immutable cache headers for its
                    # hashed assets, so disabling NPM-level caching here loses nothing.
                    caching_enabled: false
                devops-server-public:
                    allow_websocket_upgrade: true
                    domains:
                        - devops-server-{{ __cs_cluster_domain }}
                    forward_host: "{{ __devops_server_local_url | ansible.builtin.urlsplit(query='hostname') }}"
                    forward_port: "{{ __devops_server_local_url | ansible.builtin.urlsplit(query='port')
                        | ansible.builtin.int }}"
                    forward_scheme: "{{ __devops_server_local_url | ansible.builtin.urlsplit(query='scheme') }}"
                    mtls_outbound: false
                dashboard-public:
                    allow_websocket_upgrade: true
                    domains:
                        - dashboard-{{ __cs_cluster_domain }}
                    forward_host: "{{ lookup('vault_kv_get',
                        __cs_secrets_path_prefix + '/' + cs_cluster_name + '/hosts/rb5-m3')['host'] }}"
                    forward_port: 10333
                    forward_scheme: "http"
                    mtls_outbound: false
        s1-home:
            cs_vm_attached_luks_ext4_disks:
                - "internal-hdd-01"

            cs_nfs_server_mount:
                - source_directory: /mnt/internal-hdd-01
                  client_ip_cidr: "{{ __cs_cluster_cidr }}"

            cs_samba_shares:
                internal-hdd-01:
                    path: /mnt/internal-hdd-01
            __cs_nc_public_domain: "{{ lookup('vault_kv_get',
                __cs_secrets_path_prefix + '/' + cs_cluster_name + '/hosts/' + inventory_hostname)['host'] }}"
            __cs_nc_public_port: "{{ lookup('vault_kv_get',
                __cs_secrets_path_prefix + '/' + cs_cluster_name + '/hosts/' + inventory_hostname +
                '/apps/nextcloud/config')['apache_port'] | ansible.builtin.string }}"
            cs_nc_public_uri: "https://{{ __cs_nc_public_domain }}:{{ __cs_nc_public_port }}"
            cs_nc_extra_trusted_domains:
                - "nextcloud-{{ __cs_cluster_domain }}"
            cs_nc_external_drive_mount_web_paths:
                /mnt/internal-hdd-01/local-mnt-nextcloud:
                    disk_path: /mnt/internal-hdd-01/local-mnt-nextcloud
                    group: local-mnt-nextcloud
                    readonly: false
                /mnt/internal-hdd-01/backup-personal:
                    disk_path: /mnt/internal-hdd-01/backup-personal
                    group: local-mnt-backup
                /mnt/internal-hdd-01/backup-system:
                    disk_path: /mnt/internal-hdd-01/backup-system
                    group: local-mnt-backup
                /mnt/internal-hdd-01/backup-tkmghi:
                    disk_path: /mnt/internal-hdd-01/backup-tkmghi
                    group: local-mnt-backup-tkmghi
            cs_nc_restic_node_name: s1-dev
            cs_vikunja_restic_node_name: s1-dev
            cs_minio_s3_data_dir: "/mnt/internal-hdd-01/minio/{{ cs_minio_s3_cluster_name }}"

            __cs_vikunja_public_domain: "{{ lookup('vault_kv_get',
                __cs_secrets_path_prefix + '/' + cs_cluster_name + '/hosts/' + inventory_hostname)['host'] }}"
            __cs_vikunja_public_port: "{{ lookup('vault_kv_get',
                __cs_secrets_path_prefix + '/' + cs_cluster_name + '/hosts/' + inventory_hostname +
                '/apps/vikunja/config')['port'] | ansible.builtin.string }}"
            cs_vikunja_public_uri: "http://{{ __cs_vikunja_public_domain }}:{{ __cs_vikunja_public_port }}"
            cs_vikunja_extra_cors_origins:
                - "https://vikunja-{{ __cs_cluster_domain }}"

            cs_qbittorrent_nox_restic_node_name: s1-dev
            cs_qbittorrent_nox_container_media_mounts:
                - source: /mnt/internal-hdd-01/qbittorrent_nox_downloads/
                  read_only: false
                  target: /mnt/internal-hdd-01/qbittorrent_nox_downloads/
                  type: bind
            cs_qbittorrent_nox_download_dir: /mnt/internal-hdd-01/qbittorrent_nox_downloads/
            cs_qbittorrent_nox_public_uri:
                - "https://qbittorrent-nox-{{ __cs_cluster_domain }}"
                - "https://qbn-{{ __cs_cluster_domain }}"
        sash-m1:

        s1-dev:
            cs_vm_attached_luks_ext4_disks:
                - "internal-ssd-04"
                - "external-hdd-15"
                - "external-hdd-02"

            cs_nfs_client_mount:
                - inventory_hostname: s1-home
                  source_directory: /mnt/internal-hdd-01
                  mount_path: /mnt/internal-hdd-01

            cs_samba_shares:
                internal-ssd-04:
                    path: /mnt/internal-ssd-04
                external-hdd-15:
                    path: /mnt/external-hdd-15
                external-hdd-02:
                    path: /mnt/external-hdd-02

            cs_emby_container_dri_list:
                - /dev/dri/:/dev/dri/
            cs_emby_container_media_mounts:
                - source: /mnt/external-hdd-15/media/
                  read_only: false
                  target: /mnt/external-hdd-15/media/
                  type: bind

            cs_jellyfin_container_dri_list:
                - /dev/dri/:/dev/dri/
            cs_jellyfin_container_media_mounts:
                - source: /mnt/external-hdd-02/differ/
                  read_only: false
                  target: /mnt/external-hdd-02/differ/
                  type: bind

            cs_navidrome_container_media_mounts:
                - source: /mnt/external-hdd-02/audio/
                  read_only: true
                  target: /mnt/external-hdd-02/audio/
                  type: bind

            cs_nfs_server_mount:
                - source_directory: /mnt/internal-ssd-04
                  client_ip_cidr: "{{ __cs_cluster_cidr }}"
                - source_directory: /mnt/external-hdd-15
                  client_ip_cidr: "{{ __cs_cluster_cidr }}"
                - source_directory: /mnt/external-hdd-02
                  client_ip_cidr: "{{ __cs_cluster_cidr }}"

            cs_restic_sftp_repos_root: /mnt/internal-ssd-04/{{ cs_cluster_name }}-restic-sftp-repos
            cs_restic_repos:
                reverse_proxy: {}
                code-server: {}
                emby: {}
                jellyfin: {}
                navidrome: {}
                nextcloud: {}
                qbittorrentnox: {}
                vikunja: {}
        localhost: