---
# Spolecne promenne pro vsechny playbooky
# Zkopiruj na group_vars/all.yml a dopln

# ============================================
# DEPLOY USER (UID 1000)
# ============================================
deploy_user: deploy
deploy_uid: 1000
deploy_groups:
  - docker
  - sudo
  - adm
  - systemd-journal

# Verejne SSH klice pro deploy uzivatele
# Pridej sve klice (verejnou cast z `cat ~/.ssh/id_ed25519.pub`)
deploy_ssh_public_keys:
  - "ssh-ed25519 AAAAC3Nz... hermes@mac"   # <-- nahrad svym klicem

# ============================================
# DOCKER
# ============================================
docker_compose_version: "v2.27.0"
docker_daemon_config:
  log-driver: json-file
  log-opts:
    max-size: "10m"
    max-file: "3"
  storage-driver: overlay2
  live-restore: true
  userland-proxy: false

# Sluzby k nasazeni (seznam nazvu adresaru v docker-services/)
services_to_deploy:
  - portainer
  - nginx-proxy-manager
  - vaultwarden
  - gitea
  - jotty
  - nextcloud-aio
  - rustdesk
  - audiobookshelf
  - calibre-web
  - plex
  - erugo
  - jswiki
  - speedtest
  - watchtower

# ============================================
# NETWORK / FIREWALL
# ============================================
ssh_port: 22
allowed_ports:
  - { port: 22, proto: tcp, comment: "SSH" }
  - { port: 80, proto: tcp, comment: "HTTP" }
  - { port: 443, proto: tcp, comment: "HTTPS" }

# ============================================
# SECURITY (fail2ban)
# ============================================
fail2ban_maxretry: 5
fail2ban_bantime: 3600

# ============================================
# SLUZBY (credentials po prvnim spusteni)
# ============================================
npm_default_email: admin@example.com
npm_default_password: changeme

gitea_admin_user: admin
gitea_admin_password: changeme
gitea_admin_email: admin@example.com