---
# Seerr container image and version
seerr_image: ghcr.io/seerr-team/seerr
seerr_version: latest

# Network
seerr_port: 5055

# Timezone and log level (error/warn/info/debug)
seerr_timezone: UTC
seerr_log_level: info

# Config holds the SQLite database (users, requests, settings)
seerr_config_dir: "{{ podman_projects_dir }}/seerr/config"

# The image runs as the unprivileged `node` user (UID/GID 1000). Rootless
# podman maps the pod user onto that UID so the container can write the
# host-owned config directory.
seerr_container_uid: 1000
seerr_container_gid: 1000

# Backup manifest - consumed by roles/backup via inventory `backup_jobs`
seerr_backup_paths:
  - "{{ seerr_config_dir }}"

# Nginx reverse proxy configuration
seerr_nginx_enabled: false
seerr_nginx_hostname: seerr.nas.local
# Let's Encrypt (certbot) requires a publicly-resolvable hostname. Internal
# names (e.g. *.nas.local) cannot get a public cert: leave this false to use
# the shared self-signed cert (nginx_default_ssl_cert). Set true once a public
# DNS record points at the host.
seerr_nginx_letsencrypt: false
seerr_nginx_ssl_certificate: >-
  {{ seerr_nginx_letsencrypt | ternary(
     '/etc/letsencrypt/live/' ~ seerr_nginx_hostname ~ '/fullchain.pem',
     nginx_default_ssl_cert) }}
seerr_nginx_ssl_certificate_key: >-
  {{ seerr_nginx_letsencrypt | ternary(
     '/etc/letsencrypt/live/' ~ seerr_nginx_hostname ~ '/privkey.pem',
     nginx_default_ssl_key) }}