---
# The Proxmox LXC created by src/forgejo/terraform (VMID 160), on
# turtle-proxmox-02. Named for the container's hostname, which is how it
# appears in the API-backed dynamic inventory.
#
# This was empty for a long time while Forgejo also ran as a Compose stack on
# nas2 — two deployments sharing one Vault path and one database means the
# second to start wins and the other quietly serves stale state. nas2 has
# since been retired, so there is no longer a second copy to collide with and
# the `apps:` list below is live.
#
# WHAT THIS DOES NOT DO: nothing here moves repository data. Ansible
# provisions the database and installs the app; a Forgejo with no
# /var/lib/forgejo/data/forgejo-repositories is a working, empty forge. If the
# nas2 repositories still exist somewhere, restore them into
# `FORGEJO_DATA_PATH` and `chown -R git:git /var/lib/forgejo/data` before
# pointing DNS at this host — the original instructions here were an rsync
# off nas2, which is no longer a machine that can be read from.
#
# Also note SSH clone URLs move from port 2222 to 22 (see FORGEJO_SSH_PORT in
# src/forgejo/ansible/proxmox/vars.yml): existing remotes need editing.
#
# They also move to a different *hostname*. HTTP for git.turtlesystems.uk is
# proxied by Caddy, which is a different machine and has no sshd, so SSH is
# advertised as src.turtlesystems.uk instead (FORGEJO_SSH_DOMAIN, same file) —
# and it is that name, not the web one, that has to resolve to `ansible_host`
# below. SSH has no SNI, so this split is forced by the protocol rather than
# being a Caddy shortcoming; the reasoning is in vars.yml.

# The address Terraform assigns this guest (build/config/terraform/main.tf).
# Pinned here rather than left to DNS: the API-backed dynamic inventory
# supplies no `ansible_host`, so without this Ansible SSHes to the bare
# inventory name `forgejo`, which the LAN's resolver has no record for at
# all. These addresses are hand-assigned from the 192.168.50.50-.59 band
# anyway, so restating one here duplicates nothing that was ever derived.
ansible_host: 192.168.50.52

apps:
  - name: forgejo
    src: forgejo
    vault_path: homelab/forgejo
    db:
      # The shared Postgres LXC, reached over the LAN. Unlike the Unraid
      # host_vars this can't be `{{ ansible_host }}` — that would be this
      # container's own address, not the database's. Keep in step with
      # DB_HOST in src/forgejo/ansible/proxmox/vars.yml; the authoritative
      # copy of both is the `postgres_address` output in
      # build/config/terraform/main.tf.
      #
      # Provisioning runs from the Ansible controller (`delegate_to:
      # localhost` in roles/lxc_app), so this address has to be reachable
      # from wherever you run the playbook, not just from this container.
      provision_host: 192.168.50.54
      provision_port: 5432
      name: forgejo
      user: forgejo
      password_vault_key: DB_PASSWORD
      admin_vault_path: homelab/shared/postgres