---
# Portable config — values that hold regardless of where WatchState runs.
# Platform-specific values (filesystem paths, the UID/GID the container writes
# as) live in ../ansible/<platform>/vars.yml and are merged over these at
# deploy time.
env_defaults:
  # Upstream publishes a rolling `latest` plus dated `YYYYMMDD` tags; there is
  # no semver release tag to pin to. `latest` for now, same as
  # JELLYFIN_VERSION in ../../jellyfin/common/vars.yml — read a dated tag off
  # https://github.com/ArabCoders/watchstate/pkgs/container/watchstate and
  # replace this before relying on it for anything but a throwaway test.
  WATCHSTATE_VERSION: latest

  # Published port on the host. The container always listens on 8080
  # internally (EXPOSE 8080, and the image's own HEALTHCHECK hard-codes it),
  # so that side of the mapping in docker-compose.yml is fixed — only this
  # one is configurable.
  #
  # Deliberately NOT 8080, unlike Jellyfin keeping 8096 on both sides: 8080 is
  # a high-collision port on an Unraid box (qBittorrent, SABnzbd and friends
  # default to it), and this repo has no view of what else nas1 publishes. Set
  # to whatever is free; the WebUI label and the LAN URL follow it.
  WATCHSTATE_HTTP_PORT: "8580"

  # Timezone WatchState stamps its scheduled-task run times and logs with.
  # The image defaults WS_TZ to UTC; the real value is Unraid-specific and set
  # in ../ansible/unraid/vars.yml (TZ), read here via WS_TZ in
  # docker-compose.yml's environment block.

  # No Vault secrets today — WatchState's first-run flow creates a system user
  # through its own web wizard, and every backend (Plex, Jellyfin) is added
  # afterwards from the WebUI or `docker exec -ti watchstate console`, with its
  # API token stored in /config, not injected as an env var. Same situation as
  # Jellyfin: the compose_stack role still looks up `homelab/watchstate`
  # unconditionally, so the KV path has to exist before the first deploy even
  # if it holds nothing — `vault kv put kv/homelab/watchstate placeholder=unused`
  # is enough. Revisit if a future version grows a pre-settable API key or an
  # OIDC secret (see docs/vault-secrets.md).

  # STACK_ICON is supplied by the compose_stack role, from a committed
  # ../ansible/unraid/icon.png — not set here, and none is committed yet, so
  # the Docker page shows Unraid's placeholder until one is added. Uncomment
  # to use a hosted icon instead:
  #
  #   STACK_ICON: https://example.org/watchstate.png