#SPDX-License-Identifier: MIT-0
---
# defaults file for ansible-role-www
www_cron_schedule: "*/15 * * * *"
www_username: test@example.com
www_password: ""
www_imap_server: imap.example.com
www_save_dir: /data
www_ftp_user: ""
www_ftp_password: ""
www_ftp_pasv_address: example.com
www_repo_url: https://git.example.com/organization/www.git

# Kubernetes deployment (existing archive, Prometheus and Tor are retained).
www_namespace: www
www_hostname: www.example.com
www_ingress_class: nginx
www_cluster_issuer: letsencrypt-prod
# Set to your published website image, including any required metrics exporter.
www_httpd_image: registry.example.com/organization/www:release
www_source_image: debian:trixie
www_repo_version: HEAD
www_rollout_revision: ""
www_archive_storage_size: 10Gi
# Enable only when the Tor controller and OnionService CRD are installed.
www_onion_enabled: false
www_wait_timeout: 600
www_image_pull_secrets: []

www_membership_enabled: false
# Build/push www/membership/Dockerfile first. Use an immutable release/digest.
www_membership_image: ""
www_membership_image_pull_policy: IfNotPresent
www_membership_replicas: 2
www_membership_worker_interval: 60
www_membership_secret_name: membership
# Empty uses an existing Kubernetes Secret. Otherwise supply via Vault/lookup.
www_membership_secret_data: {}
www_membership_ca_secret_name: ""
www_membership_resources:
  requests: {cpu: 100m, memory: 128Mi}
  limits: {cpu: "1", memory: 512Mi}
www_membership_worker_resources:
  requests: {cpu: 100m, memory: 128Mi}
  limits: {cpu: "1", memory: 512Mi}
www_membership_postgres_managed: true
www_membership_postgres_image: postgres:17
www_membership_postgres_storage_size: 10Gi
# Empty uses the cluster default StorageClass. The claim is never auto-deleted.
www_membership_postgres_storage_class: ""
www_membership_postgres_resources:
  requests: {cpu: 100m, memory: 256Mi}
  limits: {cpu: "2", memory: 1Gi}
www_membership_stripe_enabled: false
www_membership_shkeeper_enabled: false
www_membership_environment_overrides: {}

# Public settings only. Credentials belong in the membership Secret.
www_membership_environment:
  MEMBERSHIP_PUBLIC_URL: "https://{{ www_hostname }}"
  MEMBERSHIP_ALLOW_HTTP: "0"
  MEMBERSHIP_TRUST_PROXY: "1"
  MEMBERSHIP_TIERS_FILE: /etc/membership/tiers/tiers.json
  POSTGRES_HOST: membership-db
  POSTGRES_PORT: "5432"
  POSTGRES_DB: membership
  POSTGRES_USER: membership
  POSTGRES_SSLMODE: prefer
  DEX_ISSUER: https://dex.example.com
  DEX_CLIENT_ID: www-membership
  DEX_CONNECTOR_ID: www-ldap
  LDAP_URL: ldaps://ldap.example.com
  LDAP_BIND_DN: ""
  LDAP_ACCOUNT_BASE_DN: ou=www,ou=people,dc=example,dc=com
  LDAP_SEARCH_BASE_DN: ou=people,dc=example,dc=com
  LDAP_PASSWORD_SCHEME: ""
  LDAP_GROUP_PLACEHOLDER_DN: cn=membership-sentinel,ou=system,dc=example,dc=com
  LDAP_CA_CERT_FILE: ""
  EMAIL_HOST: ""
  EMAIL_PORT: "587"
  EMAIL_HOST_USER: ""
  EMAIL_USE_TLS: "1"
  DEFAULT_FROM_EMAIL: accounts@example.com
  STRIPE_LIVE_MODE: "0"
  STRIPE_PORTAL_CONFIGURATION: ""
  SHKEEPER_URL: ""
  SHKEEPER_CURRENCIES: ""
  SHKEEPER_CA_CERT_FILE: ""

# Configure your own tiers in inventory with label, price_id, price_label,
# usd_amount and group_dn. Use your own Stripe prices and precreated LDAP groups.
# An empty mapping disables paid tiers; no live prices are included by default.
www_membership_tiers: {}