{#
  Rendered by Ansible from src/forgejo/common/vars.yml merged with
  ../vars.yml (as `app_config`), plus Vault path homelab/forgejo (as
  `vault_secrets`). The native-install equivalent of the
  FORGEJO__section__KEY environment variables in ../../unraid/docker-compose.yml.

  Do not edit this file on the host — the next deploy overwrites it. It is
  root-owned and group-readable by Forgejo precisely so Forgejo cannot rewrite
  it behind Ansible's back.

  Note what is NOT configured here: every path Forgejo stores state under is
  left at its default beneath APP_DATA_PATH — indexers, queues, sessions,
  avatars, packages. That is deliberate. All of it sitting on the container's
  own disk is what makes a vzdump of this guest a complete copy of Forgejo's
  filesystem state.
#}
APP_NAME = Forgejo
RUN_USER = {{ app_config.FORGEJO_USER }}
RUN_MODE = prod
WORK_PATH = {{ app_config.FORGEJO_WORK_PATH }}

[server]
PROTOCOL = http
DOMAIN = {{ app_config.FORGEJO_DOMAIN }}
ROOT_URL = {{ app_config.FORGEJO_ROOT_URL }}
HTTP_ADDR = 0.0.0.0
HTTP_PORT = {{ app_config.FORGEJO_HTTP_PORT }}
APP_DATA_PATH = {{ app_config.FORGEJO_DATA_PATH }}
{# The container's own sshd serves git over SSH, so Forgejo only advertises
   the address and manages the git user's authorized_keys. On Unraid this was
   Forgejo's built-in server behind a published Docker port. #}
SSH_DOMAIN = {{ app_config.FORGEJO_DOMAIN }}
SSH_PORT = {{ app_config.FORGEJO_SSH_PORT }}
START_SSH_SERVER = false
DISABLE_SSH = false
LFS_START_SERVER = true
LFS_JWT_SECRET = {{ vault_secrets.LFS_JWT_SECRET }}

[database]
DB_TYPE = postgres
HOST = {{ app_config.DB_HOST }}:{{ app_config.DB_PORT }}
NAME = {{ app_config.DB_NAME }}
USER = {{ app_config.DB_USER }}
PASSWD = {{ vault_secrets.DB_PASSWORD }}
{# The shared Postgres publishes a plain port on the LAN and has no TLS
   configured — see src/shared/postgres/ansible/unraid/docker-compose.yml.
   Change both together if that ever gains a certificate. #}
SSL_MODE = disable

[repository]
ROOT = {{ app_config.FORGEJO_DATA_PATH }}/forgejo-repositories

[security]
{# Fully configured from Vault, so skip the web installer entirely — without
   this, a fresh container serves the setup wizard on first boot and would
   write its own app.ini over this one. #}
INSTALL_LOCK = true
SECRET_KEY = {{ vault_secrets.SECRET_KEY }}
INTERNAL_TOKEN = {{ vault_secrets.INTERNAL_TOKEN }}

[oauth2]
JWT_SECRET = {{ vault_secrets.JWT_SECRET }}

[oauth2_client]
{# Policy for signing in through an external OIDC provider (Authentik). The
   provider itself is NOT configured here and cannot be: Forgejo keeps
   authentication sources in its database, added once with
   `forgejo admin auth add-oauth` — see step 8 of docs/forgejo-proxmox.md.
   This section only decides what happens to a user who has just
   authenticated there. #}

{# Create a Forgejo account on first successful OIDC login. Without this,
   Authentik authenticates the user and Forgejo then has nobody to log in as.
   Gated by the registration settings below, not independent of them. #}
ENABLE_AUTO_REGISTRATION = true

{# Attach an OIDC identity to an existing local account when the email
   matches, rather than creating a second one alongside it. This is what lets
   the break-glass admin from step 4b become the same account you arrive as
   through Authentik, instead of demoting you to a fresh unprivileged user on
   first SSO login. `login` would ask the user to confirm by entering their
   local password; `auto` links silently, which is only safe because
   Authentik is the sole source of verified addresses here. #}
ACCOUNT_LINKING = auto

{# Take the Forgejo username from the provider's preferred_username claim.
   The alternative, `userid`, would name accounts after Authentik's opaque
   subject UUID. #}
USERNAME = nickname

[service]
{# INSTALL_LOCK skips the wizard, which is also where these would have been
   chosen.

   These two are a pair and the combination is deliberate. DISABLE_REGISTRATION
   cannot stay `true` once SSO is wanted: it blocks OIDC auto-registration as
   well as the local signup form, so Authentik logins authenticate correctly
   and are then refused an account — which reads like a broken provider rather
   than a policy setting. ALLOW_ONLY_EXTERNAL_REGISTRATION restores exactly
   the property that was wanted: no self-service signup, accounts only through
   a configured provider.

   Safe to have in place before the Authentik source exists. With no external
   provider configured, "only external registration" permits nothing, so this
   is not a window during which the forge is open — flipping the first value
   alone would have been. #}
DISABLE_REGISTRATION = false
ALLOW_ONLY_EXTERNAL_REGISTRATION = true
REQUIRE_SIGNIN_VIEW = false

[log]
{# journald, via systemd capturing stdout — `journalctl -u forgejo`. ROOT_PATH
   still matters: some subsystems write their own files regardless. #}
MODE = console
LEVEL = info
ROOT_PATH = {{ app_config.FORGEJO_LOG_PATH }}