---
# Non-secret variables
domain_base: "csrx.ru"

# Derived domains
domain_vault:    "vault.{{ domain_base }}"
domain_git:      "git.{{ domain_base }}"
domain_plane:    "plane.{{ domain_base }}"
domain_sync:     "sync.{{ domain_base }}"
domain_traefik:    "traefik.{{ domain_base }}"
domain_dashboard:  "dashboard.{{ domain_base }}"
domain_auth:       "auth.{{ domain_base }}"
domain_status:     "status.{{ domain_base }}"

# Service paths
services_root: /opt/services
deploy_user: deploy
deploy_group: deploy

# Secrets (from vault)
acme_email:                   "{{ vault_acme_email }}"
vaultwarden_admin_token:      "{{ vault_vaultwarden_admin_token }}"
forgejo_db_password:          "{{ vault_forgejo_db_password }}"
plane_db_password:            "{{ vault_plane_db_password }}"
plane_secret_key:             "{{ vault_plane_secret_key }}"
plane_minio_password:         "{{ vault_plane_minio_password }}"
traefik_dashboard_htpasswd:   "{{ vault_traefik_dashboard_htpasswd }}"
syncthing_basic_auth_htpasswd: "{{ vault_syncthing_basic_auth_htpasswd }}"
forgejo_runner_token:         "{{ vault_forgejo_runner_token }}"
grafana_admin_password:           "{{ vault_grafana_admin_password }}"
alertmanager_telegram_token:      "{{ vault_alertmanager_telegram_token }}"
alertmanager_telegram_chat_id:    "{{ vault_alertmanager_telegram_chat_id }}"
authelia_jwt_secret:              "{{ vault_authelia_jwt_secret }}"
authelia_session_secret:          "{{ vault_authelia_session_secret }}"
authelia_storage_key:             "{{ vault_authelia_storage_key }}"
authelia_admin_password_hash:     "{{ vault_authelia_admin_password_hash }}"
crowdsec_bouncer_key:             "{{ vault_crowdsec_bouncer_key }}"
s3_access_key:                    "{{ vault_s3_access_key }}"
s3_secret_key:                    "{{ vault_s3_secret_key }}"

# CI/CD deploy key (public key — not a secret)
ci_deploy_pubkey: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHdr9mRSSUqt7Ym4wA5RpVyz76wEXSOtVfh2/yCSMIbg ci-deploy@forgejo-runner"