---
metabase_version: latest
metabase_image: metabase/metabase

# Host port (Metabase listens on 3000 inside the container; 3000 is reserved
# for dev/testing on the host, following gitea 3100 / grafana 3200 / uptime-kuma 3300)
metabase_port: 3400

metabase_postgres_db_name: metabase
metabase_postgres_user: metabase
# metabase_postgres_password: ""  # Intentionally undefined - role will fail if not set
# metabase_postgres_host: ""      # Must be set in inventory (e.g. "{{ podman_gw_gateway }}")
metabase_postgres_port: 5432

metabase_timezone: UTC

metabase_nginx_enabled: false
metabase_nginx_hostname: metabase.nas.local
# Let's Encrypt (certbot) requires a publicly-resolvable hostname. Internal
# names (e.g. *.nas.local) cannot get a public cert: leave this false to use
# the shared self-signed cert (nginx_default_ssl_cert). Set true once a public
# DNS record points at the host.
metabase_nginx_letsencrypt: false
metabase_nginx_ssl_certificate: >-
  {{ metabase_nginx_letsencrypt | ternary(
     '/etc/letsencrypt/live/' ~ metabase_nginx_hostname ~ '/fullchain.pem',
     nginx_default_ssl_cert) }}
metabase_nginx_ssl_certificate_key: >-
  {{ metabase_nginx_letsencrypt | ternary(
     '/etc/letsencrypt/live/' ~ metabase_nginx_hostname ~ '/privkey.pem',
     nginx_default_ssl_key) }}