---
# Grafana version
grafana_version: "stable"

# Network configuration
grafana_http_port: 3200
grafana_domain: grafana.nas.local
grafana_root_url: "https://{{ grafana_domain }}"

# PostgreSQL Database configuration
# The user and database will be created by this role.
# REQUIRED: The password must be set in your inventory (e.g., in inventory/host_vars/your_host.yml).
grafana_postgres_type: postgres
grafana_postgres_host: 127.0.0.1
grafana_postgres_port: 5432
grafana_postgres_db_name: grafana
grafana_postgres_user: grafana
# grafana_postgres_password: ""  # Intentionally undefined - role will fail if not set
grafana_postgres_ssl_mode: "prefer" # 'disable', 'allow', 'prefer', 'require', 'verify-ca', 'verify-full'

# Security
# REQUIRED: These values must be set in your inventory.
grafana_admin_user: admin
# grafana_admin_password: ""  # Intentionally undefined - role will fail if not set
# grafana_secret_key: ""      # Intentionally undefined - role will fail if not set

# Analytics
grafana_reporting_enabled: false
grafana_check_for_updates: false

# Nginx reverse proxy
grafana_nginx_enabled: true
grafana_nginx_hostname: "{{ grafana_domain }}"
# Let's Encrypt (certbot) requires a publicly-resolvable hostname. Internal
# names (e.g. *.nas.local) cannot get a public cert: leave this false to use
# the shared self-signed cert (nginx_default_ssl_cert). Set true once a public
# DNS record points at the host.
grafana_nginx_letsencrypt: false
grafana_nginx_ssl_certificate: >-
  {{ grafana_nginx_letsencrypt | ternary(
     '/etc/letsencrypt/live/' ~ grafana_nginx_hostname ~ '/fullchain.pem',
     nginx_default_ssl_cert) }}
grafana_nginx_ssl_certificate_key: >-
  {{ grafana_nginx_letsencrypt | ternary(
     '/etc/letsencrypt/live/' ~ grafana_nginx_hostname ~ '/privkey.pem',
     nginx_default_ssl_key) }}

# Alerting (Grafana Unified Alerting → ntfy webhook)
# When enabled, provisions disk alert rules (HDD temperature + ZFS/filesystem
# capacity), notification policies and an ntfy contact point using ntfy's
# built-in "grafana" webhook template.
grafana_alerting_enabled: false
# Webhook URL of the target ntfy topic. Keep ?template=grafana so ntfy parses
# Grafana's webhook payload into a readable title/message.
# grafana_ntfy_webhook_url: "https://ntfy.example.com/sys-alerts?template=grafana"
# ntfy access token with write access to the topic (set in inventory/vault).
# grafana_ntfy_token: ""