---
# ---------------------------------------------------------------------------
# Host layout
# ---------------------------------------------------------------------------
stack_root: /opt/stack
storage_root: /storage
stack_owner: tim
stack_group: tim

# Media tree lives on the 1TB disk
data_dir: "{{ storage_root }}"
config_dir: "{{ stack_root }}/config"
models_dir: "{{ stack_root }}/models/bonsai"
workspace_dir: "{{ stack_root }}/workspace"
wireguard_dir: "{{ stack_root }}/wireguard"

# LAN (SER5 is 192.168.8.123)
lan_subnet: 192.168.8.0/24
timezone: America/Los_Angeles

# ---------------------------------------------------------------------------
# Packages
# ---------------------------------------------------------------------------
# Always-on essentials (explicit — also listed in common_packages)
essential_packages:
  - curl
  - wget
  - nano
  - build-essential
  - net-tools

# Microsoft Edit (https://github.com/microsoft/edit) — terminal editor
ms_edit_version: "2.0.0"
ms_edit_install: true

common_packages:
  # essentials
  - curl
  - wget
  - nano
  - build-essential
  - net-tools
  # system / packaging
  - ca-certificates
  - gnupg
  - apt-transport-https
  - software-properties-common
  - git
  - python3
  - python3-pip
  - python3-venv
  - cmake
  - ninja-build
  - pkg-config
  # editors / viewers
  - vim
  - less
  # monitoring / disk
  - htop
  - btop
  - iotop
  - iftop
  - ncdu
  - duf
  - sysstat
  - smartmontools
  - lm-sensors
  - nvme-cli
  # network
  - iproute2
  - dnsutils
  - traceroute
  - mtr-tiny
  - nmap
  - tcpdump
  # utils
  - tree
  - jq
  - ripgrep
  - fd-find
  - fzf
  - tmux
  - rsync
  - unzip
  - zip
  - p7zip-full
  - lsof
  - strace
  - pciutils
  - usbutils
  - plocate
  - bat
  - aria2
  # security / updates
  - fail2ban
  - unattended-upgrades
  - update-notifier-common

# Start stack on boot (docker compose up -d); pairs with restart: unless-stopped
stack_systemd_enable: true
stack_compose_profiles: []   # e.g. ["coding"] to also start openhands

# AMD / Vulkan / media accel (Radeon 680M on SER5 PRO)
# Note: Ubuntu 24.04 uses mesa-va-drivers (not the older libva-mesa-driver name).
# Many of these live in the "universe" component — role enables it first.
amd_vulkan_packages:
  - linux-firmware
  - mesa-vulkan-drivers
  - mesa-utils
  - libvulkan1
  - vulkan-tools
  - libgl1-mesa-dri
  - libegl1
  - libgles2
  - vainfo
  - libva2
  - libva-drm2
  - mesa-va-drivers
  - mesa-vdpau-drivers
  - clinfo

# Groups for operator account (tim) — local trusted host, convenience over lockdown
extra_user_groups:
  - sudo
  - docker
  - video
  - render
  - adm
  - disk
  - plugdev
  - dialout
  - cdrom
  - users
  - systemd-journal
  # present on many Ubuntu images; harmless if already primary
  - tim

# Passwordless full sudo for stack_owner (local monitored network)
stack_passwordless_sudo: true

# ---------------------------------------------------------------------------
# Docker
# ---------------------------------------------------------------------------
docker_packages:
  - docker-ce
  - docker-ce-cli
  - containerd.io
  - docker-buildx-plugin
  - docker-compose-plugin

docker_daemon_json:
  log-driver: json-file
  log-opts:
    max-size: "50m"
    max-file: "5"
  # Leave room for media + inference
  default-address-pools:
    - base: 172.30.0.0/16
      size: 24
  # Enable cgroup device access patterns used by /dev/dri
  features:
    buildkit: true

# ---------------------------------------------------------------------------
# Firewall (UFW) — default deny in, allow out; open stack ports to LAN only
# ---------------------------------------------------------------------------
ufw_enabled: true
ufw_default_incoming: deny
ufw_default_outgoing: allow

# SSH from anywhere on LAN (and optionally world — keep LAN-only by default)
ufw_allow_ssh_from_anywhere: false

ufw_lan_tcp_ports:
  - { port: 22, comment: "SSH" }
  - { port: 8080, comment: "qBittorrent" }
  - { port: 8096, comment: "Jellyfin" }
  - { port: 8989, comment: "Sonarr" }
  - { port: 7878, comment: "Radarr" }
  - { port: 9696, comment: "Prowlarr" }
  - { port: 6767, comment: "Bazarr" }
  - { port: 8686, comment: "Lidarr" }
  - { port: 3000, comment: "Open WebUI" }
  - { port: 8081, comment: "Bonsai llama-server" }
  - { port: 3001, comment: "OpenHands (optional)" }
  - { port: 3002, comment: "Forgejo HTTP" }
  - { port: 2222, comment: "Forgejo Git SSH" }

# Forgejo (self-hosted Git)
forgejo_domain: "192.168.8.123"
forgejo_http_port: 3002
forgejo_ssh_port: 2222
forgejo_root_url: "http://{{ forgejo_domain }}:{{ forgejo_http_port }}/"

# ---------------------------------------------------------------------------
# Stack deployment
# ---------------------------------------------------------------------------
# Sync this repo (parent of ansible/) to stack_root on the server.
# Set false if you manage /opt/stack yourself (git clone, etc.).
deploy_stack_files: true

# Paths on the control machine (the machine running ansible-playbook)
# Default: the arr-stack repo that contains this ansible/ directory
stack_src: "{{ playbook_dir | dirname }}"

# AI defaults for SER5 + Vulkan
bonsai_backend: vulkan
bonsai_ngl: "99"
bonsai_ctx: "16384"
bonsai_threads: "12"
bonsai_kv4: "0"
open_webui_auth: "true"

# Media subdirs under storage_root
media_subdirs:
  - media/movies
  - media/tv
  - media/music
  - torrents/movies
  - torrents/tv
  - torrents/music