---
# Non-secret variables
domain_base: "walava.io"

# Derived domains
domain_git:        "git.{{ domain_base }}"
domain_plane:      "plane.{{ domain_base }}"
domain_traefik:    "traefik.{{ domain_base }}"
domain_dashboard:  "dash.{{ domain_base }}"
domain_auth:       "auth.{{ domain_base }}"
domain_status:     "status.{{ domain_base }}"
domain_wiki:       "wiki.{{ domain_base }}"
domain_n8n:        "auto.{{ domain_base }}"
domain_landing:    "{{ domain_base }}"

# Service paths
services_root: /opt/services
deploy_user: deploy
deploy_group: deploy

# Secrets (from vault)
acme_email:                       "{{ vault_acme_email }}"
forgejo_db_password:              "{{ vault_forgejo_db_password }}"
plane_db_password:                "{{ vault_plane_db_password }}"
plane_secret_key:                 "{{ vault_plane_secret_key }}"
plane_minio_password:             "{{ vault_plane_minio_password }}"
traefik_dashboard_htpasswd:       "{{ vault_traefik_dashboard_htpasswd }}"
forgejo_runner_token:             "{{ vault_forgejo_runner_token }}"
grafana_admin_password:           "{{ vault_grafana_admin_password }}"
alertmanager_telegram_token:      "{{ vault_alertmanager_telegram_token }}"
alertmanager_telegram_chat_id:    "{{ vault_alertmanager_telegram_chat_id }}"
crowdsec_bouncer_key:             "{{ vault_crowdsec_bouncer_key }}"
s3_access_key:                    "{{ vault_s3_access_key }}"
s3_secret_key:                    "{{ vault_s3_secret_key }}"
cloudflare_dns_api_token:         "{{ vault_cloudflare_dns_api_token }}"
cloudflare_zone_id:               "{{ vault_cloudflare_zone_id }}"
docmost_app_secret:               "{{ vault_docmost_app_secret }}"
docmost_db_password:              "{{ vault_docmost_db_password }}"
n8n_encryption_key:               "{{ vault_n8n_encryption_key }}"
n8n_jwt_secret:                   "{{ vault_n8n_jwt_secret }}"
discord_webhook_alerts:           "{{ vault_discord_webhook_alerts }}"
discord_webhook_deploys:          "{{ vault_discord_webhook_deploys }}"
openrouter_api_key:               "{{ vault_openrouter_api_key }}"
forgejo_api_token:                "{{ vault_forgejo_api_token }}"
resend_api_key:                   "{{ vault_resend_api_key }}"
discord_bot_token:                "{{ vault_discord_bot_token }}"
discord_bot_app_id:               "{{ vault_discord_bot_app_id }}"
discord_bot_public_key:           "{{ vault_discord_bot_public_key }}"
timeweb_token:                    "{{ vault_timeweb_token }}"

# Server IPs (used for cross-server Traefik routing)
ip_main:  "87.249.49.32"
ip_tools: "85.193.83.9"

# CI/CD deploy key (public key — not a secret)
ci_deploy_pubkey: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILQSKgqMTT7uGo423Nrb94PgQ8cu2IiH96JOrIKhlvm/ ci-deploy@forgejo-runner"