mash-playbook/templates/group_vars_mash_servers

---

# role-specific:auxiliary
########################################################################
#                                                                      #
# aux                                                                  #
#                                                                      #
########################################################################

aux_directory_default_owner: "{{ mash_playbook_user_username }}"
aux_directory_default_group: "{{ mash_playbook_user_groupname }}"

aux_file_default_owner: "{{ mash_playbook_user_username }}"
aux_file_default_group: "{{ mash_playbook_user_groupname }}"

########################################################################
#                                                                      #
# /aux                                                                 #
#                                                                      #
########################################################################
# /role-specific:auxiliary


# role-specific:authelia
########################################################################
#                                                                      #
# authelia                                                             #
#                                                                      #
########################################################################

authelia_enabled: false

authelia_identifier: "{{ mash_playbook_service_identifier_prefix }}authelia"

authelia_uid: "{{ mash_playbook_uid }}"
authelia_gid: "{{ mash_playbook_gid }}"

authelia_base_path: "{{ mash_playbook_base_path }}/{{ mash_playbook_service_base_directory_name_prefix }}authelia"

authelia_systemd_required_services_list_auto: |
  {{
    ([devture_postgres_identifier ~ '.service'] if devture_postgres_enabled and authelia_config_storage_postgres_host == devture_postgres_identifier else [])
  }}

authelia_container_additional_networks_auto: |
  {{
    ([mash_playbook_reverse_proxyable_services_additional_network] if mash_playbook_reverse_proxyable_services_additional_network else [])
    +
    ([devture_postgres_container_network] if devture_postgres_enabled and authelia_config_storage_postgres_host == devture_postgres_identifier and authelia_container_network != devture_postgres_container_network else [])
  }}

authelia_container_labels_traefik_enabled: "{{ mash_playbook_traefik_labels_enabled }}"
authelia_container_labels_traefik_docker_network: "{{ mash_playbook_reverse_proxyable_services_additional_network }}"
authelia_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
authelia_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}"

authelia_config_jwt_secret: "{{ '%s' | format(mash_playbook_generic_secret_key) | password_hash('sha512', 'jwt.authelia', rounds=655555) | to_uuid }}"

authelia_config_session_secret: "{{ '%s' | format(mash_playbook_generic_secret_key) | password_hash('sha512', 'ses.authelia', rounds=655555) | to_uuid }}"

authelia_config_identity_providers_oidc_hmac_secret: "{{ '%s' | format(mash_playbook_generic_secret_key) | password_hash('sha512', 'hm.authelia', rounds=655555) | to_uuid }}"

# role-specific:postgres
authelia_config_storage_postgres_host: "{{ devture_postgres_identifier if devture_postgres_enabled else '' }}"
authelia_config_storage_postgres_port: "{{ '5432' if devture_postgres_enabled else '' }}"
authelia_config_storage_postgres_password: "{{ '%s' | format(mash_playbook_generic_secret_key) | password_hash('sha512', 'db.authelia', rounds=655555) | to_uuid }}"
# /role-specific:postgres

# role-specific:mariadb
# If Postgres and MariaDB are not enabled, we favor Postgres.
# We only enable MySQL if it's the only enabled component (that is, if Postgres is not enabled at the same time).
authelia_config_storage_mysql_host: "{{ mariadb_identifier if mariadb_enabled and not devture_postgres_enabled | default(false) else '' }}"
authelia_config_storage_mysql_port: "{{ '3306' if mariadb_enabled else '' }}"
authelia_config_storage_mysql_password: "{{ '%s' | format(mash_playbook_generic_secret_key) | password_hash('sha512', 'db.authelia', rounds=655555) | to_uuid }}"
# /role-specific:mariadb

########################################################################
#                                                                      #
# /authelia                                                            #
#                                                                      #
########################################################################
# /role-specific:authelia



# role-specific:ssh
########################################################################
#                                                                      #
# ssh                                                                  #
#                                                                      #
########################################################################

system_security_ssh_enabled: false

########################################################################
#                                                                      #
# /ssh                                                                 #
#                                                                      #
########################################################################
# /role-specific:ssh



# role-specific:fail2ban
########################################################################
#                                                                      #
# fail2ban                                                             #
#                                                                      #
########################################################################

system_security_fail2ban_enabled: false

########################################################################
#                                                                      #
# /fail2ban                                                            #
#                                                                      #
########################################################################
# /role-specific:fail2ban



# role-specific:swap
########################################################################
#                                                                      #
# swap                                                                 #
#                                                                      #
########################################################################

system_swap_enabled: false

########################################################################
#                                                                      #
# /swap                                                                #
#                                                                      #
########################################################################
# /role-specific:swap



# role-specific:systemd_service_manager
########################################################################
#                                                                      #
# systemd_service_manager                                              #
#                                                                      #
########################################################################

mash_playbook_devture_systemd_service_manager_services_list_auto_itemized:
  # Dummy entry, which is not role-specific.
  # Ensures there's at least one entry defined in the list.
  - "{{ omit }}"

  # role-specific:backup_borg
  - |-
    {{ ({'name': (backup_borg_identifier + '.timer'), 'priority': 5000, 'groups': ['mash', 'backup', 'borg']} if backup_borg_enabled else omit) }}
  # /role-specific:backup_borg

  # role-specific:adguard_home
  - |-
    {{ ({'name': (adguard_home_identifier + '.service'), 'priority': 2000, 'groups': ['mash', 'adguard-home']} if adguard_home_enabled else omit) }}
  # /role-specific:adguard_home

  # role-specific:apisix_dashboard
  - |-
    {{ ({'name': (apisix_dashboard_identifier + '.service'), 'priority': 2000, 'groups': ['mash', 'apisix-dashboard']} if apisix_dashboard_enabled else omit) }}
  # /role-specific:apisix_dashboard

  # role-specific:apisix_gateway
  - |-
    {{ ({'name': (apisix_gateway_identifier + '.service'), 'priority': 2000, 'groups': ['mash', 'apisix-gateway']} if apisix_gateway_enabled else omit) }}
  # /role-specific:apisix_gateway

  # role-specific:appsmith
  - |-
    {{ ({'name': (appsmith_identifier + '.service'), 'priority': 2000, 'groups': ['mash', 'appsmith']} if appsmith_enabled else omit) }}
  # /role-specific:appsmith

  # role-specific:authentik
  - |-
    {{ ({'name': (authentik_server_identifier + '.service'), 'priority': 2000, 'groups': ['mash', 'authentik']} if authentik_enabled else omit) }}
  - |-
    {{ ({'name': (authentik_worker_identifier + '.service'), 'priority': 2000, 'groups': ['mash', 'authentik']} if authentik_enabled else omit) }}
  # /role-specific:authentik

  # role-specific:authelia
  - |-
    {{ ({'name': (authelia_identifier + '.service'), 'priority': 2000, 'groups': ['mash', 'authelia']} if authelia_enabled else omit) }}
  # /role-specific:authelia

  # role-specific:calibre-web
  - |-
    {{ ({'name': (calibre_web_identifier + '.service'), 'priority': 2000, 'groups': ['mash', 'calibre-web']} if calibre_web_enabled else omit) }}
  # /role-specific:calibre-web

  # role-specific:readeck
  - |-
    {{ ({'name': (readeck_identifier + '.service'), 'priority': 2000, 'groups': ['mash', 'readeck']} if readeck_enabled else omit) }}
  # /role-specific:readeck

  # role-specific:changedetection
  - |-
    {{ ({'name': (changedetection_identifier + '.service'), 'priority': 2100, 'groups': ['mash', 'changedetection']} if changedetection_enabled else omit) }}
  - |-
    {{ ({'name': (changedetection_playwright_driver_identifier + '.service'), 'priority': 2000, 'groups': ['mash', 'changedetection']} if changedetection_playwright_driver_enabled else omit) }}
  # /role-specific:changedetection

  # role-specific:wetty
  - |-
    {{ ({'name': (wetty_identifier + '.service'), 'priority': 2000, 'groups': ['mash', 'wetty']} if wetty_enabled else omit) }}
  # /role-specific:wetty

  # role-specific:clickhouse
  - |-
    {{ ({'name': (clickhouse_identifier + '.service'), 'priority': 2000, 'groups': ['mash', 'clickhouse']} if clickhouse_enabled else omit) }}
  # /role-specific:clickhouse

  # role-specific:collabora_online
  - |-
    {{ ({'name': (collabora_online_identifier + '.service'), 'priority': 2000, 'groups': ['mash', 'collabora-online']} if collabora_online_enabled else omit) }}
  # /role-specific:collabora_online

  # role-specific:couchdb
  - |-
    {{ ({'name': (couchdb_identifier + '.service'), 'priority': 2000, 'groups': ['mash', 'couchdb']} if couchdb_enabled else omit) }}
  # /role-specific:couchdb

  # role-specific:postgres
  - |-
    {{ ({'name': (devture_postgres_identifier + '.service'), 'priority': 500, 'groups': ['mash', 'postgres']} if devture_postgres_enabled else omit) }}
  # /role-specific:postgres

  # role-specific:postgres_backup
  - |-
    {{ ({'name': (devture_postgres_backup_identifier + '.service'), 'priority': 5000, 'groups': ['mash', 'backup', 'postgres-backup']} if devture_postgres_backup_enabled else omit) }}
  # /role-specific:postgres_backup

  # role-specific:container_socket_proxy
  - |-
    {{ ({'name': (devture_container_socket_proxy_identifier + '.service'), 'priority': 200, 'groups': ['mash', 'reverse-proxies', 'container-socket-proxy']} if devture_container_socket_proxy_enabled else omit) }}
  # /role-specific:container_socket_proxy

  # role-specific:traefik
  - |-
    {{ ({'name': (devture_traefik_identifier + '.service'), 'priority': 250, 'groups': ['mash', 'traefik', 'reverse-proxies']} if devture_traefik_enabled else omit) }}
  # /role-specific:traefik

  # role-specific:woodpecker_ci_server
  - |-
    {{ ({'name': (devture_woodpecker_ci_server_identifier + '.service'), 'priority': 4000, 'groups': ['mash', 'woodpecker', 'ci', 'woodpecker-ci-server']} if devture_woodpecker_ci_server_enabled else omit) }}
  # /role-specific:woodpecker_ci_server

  # role-specific:woodpecker_ci_agent
  - |-
    {{ ({'name': (devture_woodpecker_ci_agent_identifier + '.service'), 'priority': 4100, 'groups': ['mash', 'woodpecker', 'ci', 'woodpecker-ci-agent']} if devture_woodpecker_ci_agent_enabled else omit) }}
  # /role-specific:woodpecker_ci_agent

  # role-specific:docker_registry
  - |-
    {{ ({'name': (docker_registry_identifier + '.service'), 'priority': 2000, 'groups': ['mash', 'docker-registry']} if docker_registry_enabled else omit) }}
  - |-
    {{ ({'name': (docker_registry_identifier + '-garbage-collect.timer'), 'priority': 2500, 'groups': ['mash', 'docker-registry', 'docker-registry-gc']} if docker_registry_enabled else omit) }}
  # /role-specific:docker_registry

  # role-specific:docker_registry_proxy
  - |-
    {{ ({'name': (docker_registry_proxy_identifier + '.service'), 'priority': 2000, 'groups': ['mash', 'docker-registry-proxy']} if docker_registry_proxy_enabled else omit) }}
  # /role-specific:docker_registry_proxy

  # role-specific:docker_registry_browser
  - |-
    {{ ({'name': (docker_registry_browser_identifier + '.service'), 'priority': 2000, 'groups': ['mash', 'docker-registry-browser']} if docker_registry_browser_enabled else omit) }}
  # /role-specific:docker_registry_browser

  # role-specific:docker_registry_purger
  - |-
    {{ ({'name': (docker_registry_purger_identifier + '.timer'), 'priority': 3000, 'groups': ['mash', 'docker-registry-purger']} if docker_registry_purger_enabled else omit) }}
  # /role-specific:docker_registry_purger

  # role-specific:echoip
  - |-
    {{ ({'name': (echoip_identifier + '.service'), 'priority': 2000, 'groups': ['mash', 'echoip']} if echoip_enabled else omit) }}
  # /role-specific:echoip

  # role-specific:endlessh
  - |-
    {{ ({'name': (endlessh_identifier + '.service'), 'priority': 2000, 'groups': ['mash', 'endlessh']} if endlessh_enabled else omit) }}
  # /role-specific:endlessh

  # role-specific:etcd
  - |-
    {{ ({'name': (etcd_identifier + '.service'), 'priority': 500, 'groups': ['mash', 'etcd']} if etcd_enabled else omit) }}
  # /role-specific:etcd

  # role-specific:exim_relay
  - |-
    {{ ({'name': (exim_relay_identifier + '.service'), 'priority': 2000, 'groups': ['mash', 'exim-relay']} if exim_relay_enabled else omit) }}
  # /role-specific:exim_relay

  # role-specific:firezone
  - |-
    {{ ({'name': (firezone_identifier + '.service'), 'priority': 2000, 'groups': ['mash', 'firezone']} if firezone_enabled else omit) }}
  # /role-specific:firezone

  # role-specific:focalboard
  - |-
    {{ ({'name': (focalboard_identifier + '.service'), 'priority': 2000, 'groups': ['mash', 'focalboard']} if focalboard_enabled else omit) }}
  # /role-specific:focalboard

  # role-specific:freshrss
  - |-
    {{ ({'name': (freshrss_identifier + '.service'), 'priority': 2000, 'groups': ['mash', 'freshrss']} if freshrss_enabled else omit) }}
  # /role-specific:freshrss

  # role-specific:funkwhale
  - |-
    {{ ({'name': (funkwhale_api_identifier + '.service'), 'priority': 2000, 'groups': ['mash', 'funkwhale']} if funkwhale_enabled else omit) }}
  - |-
    {{ ({'name': (funkwhale_frontend_identifier + '.service'), 'priority': 2000, 'groups': ['mash', 'funkwhale']} if funkwhale_enabled else omit) }}
  - |-
    {{ ({'name': (funkwhale_celery_beat_identifier + '.service'), 'priority': 2000, 'groups': ['mash', 'funkwhale']} if funkwhale_enabled else omit) }}
  - |-
    {{ ({'name': (funkwhale_celery_worker_identifier + '.service'), 'priority': 2000, 'groups': ['mash', 'funkwhale']} if funkwhale_enabled else omit) }}
  - |-
    {{ ({'name': (funkwhale_watch_imports_identifier + '.service'), 'priority': 2000, 'groups': ['mash', 'funkwhale']} if funkwhale_enabled and funkwhale_watch_imports_enabled else omit) }}
  # /role-specific:funkwhale

  # role-specific:gitea
  - |-
    {{ ({'name': (gitea_identifier + '.service'), 'priority': 2000, 'groups': ['mash', 'gitea', 'gitea-server']} if gitea_enabled else omit) }}
  # /role-specific:gitea

  # role-specific:gotosocial
  - |-
    {{ ({'name': (gotosocial_identifier + '.service'), 'priority': 2000, 'groups': ['mash', 'gotosocial']} if gotosocial_enabled else omit) }}
  # /role-specific:gotosocial

  # role-specific:grafana
  - |-
    {{ ({'name': (grafana_identifier + '.service'), 'priority': 2000, 'groups': ['mash', 'grafana']} if grafana_enabled else omit) }}
  # /role-specific:grafana

  # role-specific:hubsite
  - |-
    {{ ({'name': (hubsite_identifier + '.service'), 'priority': 2000, 'groups': ['mash', 'hubsite']} if hubsite_enabled else omit) }}
  # /role-specific:hubsite

  # role-specific:healthchecks
  - |-
    {{ ({'name': (healthchecks_identifier + '.service'), 'priority': 2000, 'groups': ['mash', 'healthchecks']} if healthchecks_enabled else omit) }}
  # /role-specific:healthchecks

  # role-specific:ilmo
  - |-
    {{ ({'name': (ilmo_identifier + '.service'), 'priority': 2000, 'groups': ['mash', 'ilmo']} if ilmo_enabled else omit) }}
  # /role-specific:ilmo

  # role-specific:infisical
  - |-
    {{ ({'name': (infisical_identifier + '-backend.service'), 'priority': 2000, 'groups': ['mash', 'infisical', 'infisical-backend']} if infisical_enabled else omit) }}
  - |-
    {{ ({'name': (infisical_identifier + '-frontend.service'), 'priority': 2000, 'groups': ['mash', 'infisical', 'infisical-frontend']} if infisical_enabled else omit) }}
  # /role-specific:infisical

  # role-specific:influxdb
  - |-
    {{ ({'name': (influxdb_identifier + '.service'), 'priority': 2000, 'groups': ['mash', 'influxdb']} if influxdb_enabled else omit) }}
  # /role-specific:influxdb

  # role-specific:jitsi
  - |-
    {{ ({'name': (jitsi_identifier + '-web.service'), 'priority': 4200, 'groups': ['mash', 'jitsi', 'jitsi-web']} if jitsi_enabled else omit) }}
  - |-
    {{ ({'name': (jitsi_identifier + '-prosody.service'), 'priority': 4000, 'groups': ['mash', 'jitsi', 'jitsi-prosody']} if jitsi_enabled else omit) }}
  - |-
    {{ ({'name': (jitsi_identifier + '-jicofo.service'), 'priority': 4100, 'groups': ['mash', 'jitsi', 'jitsi-jicofo']} if jitsi_enabled else omit) }}
  - |-
    {{ ({'name': (jitsi_identifier + '-jvb.service'), 'priority': 4100, 'groups': ['mash', 'jitsi', 'jitsi-jvb']} if jitsi_enabled else omit) }}
  # /role-specific:jitsi

  # role-specific:keycloak
  - |-
    {{ ({'name': (keycloak_identifier + '.service'), 'priority': 1000, 'groups': ['mash', 'keycloak']} if keycloak_enabled else omit) }}
  # /role-specific:keycloak

  # role-specific:lago
  - |-
    {{ ({'name': (lago_identifier + '-api.service'), 'priority': 2000, 'groups': ['mash', 'lago', 'lago-api']} if lago_enabled else omit) }}
  - |-
    {{ ({'name': (lago_identifier + '-api-worker.service'), 'priority': 2500, 'groups': ['mash', 'lago', 'lago-api-worker']} if lago_enabled else omit) }}
  - |-
    {{ ({'name': (lago_identifier + '-api-clock.service'), 'priority': 2500, 'groups': ['mash', 'lago', 'lago-api-clock']} if lago_enabled else omit) }}
  - |-
    {{ ({'name': (lago_identifier + '-front.service'), 'priority': 2200, 'groups': ['mash', 'lago', 'lago-front']} if lago_enabled else omit) }}
  - |-
    {{ ({'name': (lago_identifier + '-pdf.service'), 'priority': 1900, 'groups': ['mash', 'lago', 'lago-pdf']} if lago_enabled else omit) }}
  # /role-specific:lago

  # role-specific:languagetool
  - |-
    {{ ({'name': (languagetool_identifier + '.service'), 'priority': 2000, 'groups': ['mash', 'languagetool']} if languagetool_enabled else omit) }}
  # /role-specific:languagetool

  # role-specific:loki
  - |-
    {{ ({'name': (loki_identifier + '.service'), 'priority': 2000, 'groups': ['mash', 'loki']} if loki_enabled else omit) }}
  # /role-specific:loki

  # role-specific:linkding
  - |-
    {{ ({'name': (linkding_identifier + '.service'), 'priority': 2000, 'groups': ['mash', 'linkding']} if linkding_enabled else omit) }}
  # /role-specific:linkding

  # role-specific:miniflux
  - |-
    {{ ({'name': (miniflux_identifier + '.service'), 'priority': 2000, 'groups': ['mash', 'miniflux']} if miniflux_enabled else omit) }}
  # /role-specific:miniflux

  # role-specific:mobilizon
  - |-
    {{ ({'name': (mobilizon_identifier + '.service'), 'priority': 2000, 'groups': ['mash', 'mobilizon']} if mobilizon_enabled else omit) }}
  # /role-specific:mobilizon

  # role-specific:mongodb
  - |-
    {{ ({'name': (mongodb_identifier + '.service'), 'priority': 2000, 'groups': ['mash', 'mongodb']} if mongodb_enabled else omit) }}
  # /role-specific:mongodb

  # role-specific:mosquitto
  - |-
    {{ ({'name': (mosquitto_identifier + '.service'), 'priority': 2000, 'groups': ['mash', 'mosquitto']} if mosquitto_enabled else omit) }}
  # /role-specific:mosquitto

  # role-specific:mrs
  - |-
    {{ ({'name': (mrs_identifier + '.service'), 'priority': 2000, 'groups': ['mash', 'mrs']} if mrs_enabled else omit) }}
  # /role-specific:mrs

  # role-specific:n8n
  - |-
    {{ ({'name': (n8n_identifier + '.service'), 'priority': 2000, 'groups': ['mash', 'n8n']} if n8n_enabled else omit) }}
  # /role-specific:n8n

  # role-specific:navidrome
  - |-
    {{ ({'name': (navidrome_identifier + '.service'), 'priority': 2000, 'groups': ['mash', 'navidrome']} if navidrome_enabled else omit) }}
  # /role-specific:navidrome

  # role-specific:neko
  - |-
    {{ ({'name': (neko_identifier + '.service'), 'priority': 2000, 'groups': ['mash', 'neko']} if neko_enabled else omit) }}
  # /role-specific:neko

  # role-specific:netbox
  - |-
    {{ ({'name': (netbox_identifier + '.service'), 'priority': 2000, 'groups': ['mash', 'netbox', 'netbox-server']} if netbox_enabled else omit) }}
  - |-
    {{ ({'name': (netbox_identifier + '-worker.service'), 'priority': 2500, 'groups': ['mash', 'netbox', 'netbox-worker']} if netbox_enabled else omit) }}
  - |-
    {{ ({'name': (netbox_identifier + '-housekeeping.service'), 'priority': 2500, 'groups': ['mash', 'netbox', 'netbox-housekeeping']} if netbox_enabled else omit) }}
  # /role-specific:netbox

  # role-specific:nextcloud
  - |-
    {{ ({'name': (nextcloud_identifier + '-server.service'), 'priority': 2000, 'groups': ['mash', 'nextcloud', 'nextcloud-server']} if nextcloud_enabled else omit) }}
  - |-
    {{ ({'name': (nextcloud_identifier + '-cron.timer'), 'priority': 2500, 'groups': ['mash', 'nextcloud', 'nextcloud-cron']} if nextcloud_enabled else omit) }}
  - |-
    {{ ({'name': (nextcloud_identifier + '-app-update.timer'), 'priority': 2500, 'groups': ['mash', 'nextcloud', 'nextcloud-app-update']} if nextcloud_enabled and nextcloud_auto_app_update_enabled else omit) }}
  # /role-specific:nextcloud

  # role-specific:notfellchen
  - |-
    {{ ({'name': (notfellchen_identifier  + '.service'), 'priority': 2000, 'groups': ['mash', 'notfellchen']} if notfellchen_enabled else omit) }}
  - |-
    {{ ({'name': (notfellchen_sws_identifier + '.service'), 'priority': 2000, 'groups': ['mash', 'notfellchen', 'notfellchen-sws']} if notfellchen_enabled else omit) }}
  # /role-specific:notfellchen

  # role-specific:mariadb
  - |-
    {{ ({'name': (mariadb_identifier + '.service'), 'priority': 500, 'groups': ['mash', 'mariadb']} if mariadb_enabled else omit) }}
  # /role-specific:mariadb

  # role-specific:oauth2_proxy
  - |-
    {{ ({'name': (oauth2_proxy_identifier + '.service'), 'priority': 1900, 'groups': ['mash', 'oauth2-proxy']} if oauth2_proxy_enabled else omit) }}
  # /role-specific:oauth2_proxy

  # role-specific:outline
  - |-
    {{ ({'name': (outline_identifier + '.service'), 'priority': 2000, 'groups': ['mash', 'outline']} if outline_enabled else omit) }}
  # /role-specific:outline

  # role-specific:owncast
  - |-
    {{ ({'name': (owncast_identifier + '.service'), 'priority': 2000, 'groups': ['mash', 'owncast']} if owncast_enabled else omit) }}
  # /role-specific:owncast

  # role-specific:oxitraffic
  - |-
    {{ ({'name': (oxitraffic_identifier + '.service'), 'priority': 2000, 'groups': ['mash', 'oxitraffic']} if oxitraffic_enabled else omit) }}
  # /role-specific:oxitraffic

  # role-specific:paperless
  - |-
    {{ ({'name': (paperless_identifier + '.service'), 'priority': 2000, 'groups': ['mash', 'paperless']} if paperless_enabled else omit) }}
  - |-
    {{ ({'name': (paperless_tika_identifier + '.service'), 'priority': 2000, 'groups': ['mash', 'paperless']} if paperless_enabled and paperless_tika_enabled else omit) }}
  - |-
    {{ ({'name': (paperless_gotenberg_identifier + '.service'), 'priority': 2000, 'groups': ['mash', 'paperless']} if paperless_enabled and paperless_gotenberg_enabled else omit) }}
  # /role-specific:paperless

  # role-specific:peertube
  - |-
    {{ ({'name': (peertube_identifier + '.service'), 'priority': 2000, 'groups': ['mash', 'peertube']} if peertube_enabled else omit) }}
  # /role-specific:peertube

  # role-specific:postgis
  - |-
    {{ ({'name': (postgis_identifier + '.service'), 'priority': 2000, 'groups': ['mash', 'metrics', 'postgis']} if postgis_enabled else omit) }}
  # /role-specific:postgis

  # role-specific:plausible
  - |-
    {{ ({'name': (plausible_identifier + '.service'), 'priority': 2000, 'groups': ['mash', 'plausible']} if plausible_enabled else omit) }}
  # /role-specific:plausible

  # role-specific:prometheus
  - |-
    {{ ({'name': (prometheus_identifier + '.service'), 'priority': 2000, 'groups': ['mash', 'metrics', 'prometheus']} if prometheus_enabled else omit) }}
  # /role-specific:prometheus

  # role-specific:prometheus_blackbox_exporter
  - |-
    {{ ({'name': (prometheus_blackbox_exporter_identifier + '.service'), 'priority': 500, 'groups': ['mash', 'metrics', 'prometheus-blackbox-exporter']} if prometheus_blackbox_exporter_enabled else omit) }}
  # /role-specific:prometheus_blackbox_exporter

  # role-specific:prometheus_ssh_exporter
  - |-
    {{ ({'name': (prometheus_ssh_exporter_identifier + '.service'), 'priority': 500, 'groups': ['mash', 'metrics', 'prometheus-ssh-exporter']} if prometheus_ssh_exporter_enabled else omit) }}
  # /role-specific:prometheus_ssh_exporter

  # role-specific:prometheus_node_exporter
  - |-
    {{ ({'name': (prometheus_node_exporter_identifier + '.service'), 'priority': 500, 'groups': ['mash', 'metrics', 'prometheus-node-exporter']} if prometheus_node_exporter_enabled else omit) }}
  # /role-specific:prometheus_node_exporter

  # role-specific:prometheus_postgres_exporter
  - |-
    {{ ({'name': (prometheus_postgres_exporter_identifier + '.service'), 'priority': 500, 'groups': ['mash', 'metrics', 'prometheus-postgres-exporter']} if prometheus_postgres_exporter_enabled else omit) }}
  # /role-specific:prometheus_postgres_exporter

  # role-specific:promtail
  - |-
    {{ ({'name': (promtail_identifier + '.service'), 'priority': 500, 'groups': ['mash', 'logs', 'promtail']} if promtail_enabled else omit) }}
  # /role-specific:promtail

  # role-specific:radicale
  - |-
    {{ ({'name': (radicale_identifier + '.service'), 'priority': 2000, 'groups': ['mash', 'radicale']} if radicale_enabled else omit) }}
  # /role-specific:radicale

  # role-specific:redmine
  - |-
    {{ ({'name': (redmine_identifier + '.service'), 'priority': 2000, 'groups': ['mash', 'redmine']} if redmine_enabled else omit) }}
  - |-
    {{ ({'name': (redmine_identifier + '-send-reminders.timer'), 'priority': 2000, 'groups': ['mash', 'redmine']} if redmine_enabled else omit) }}
  - |-
    {{ ({'name': (redmine_identifier + '-recurring-tasks.timer'), 'priority': 2000, 'groups': ['mash', 'redmine']} if redmine_enabled and redmine_recurring_tasks_enabled else omit) }}
  # /role-specific:redmine

  # role-specific:redis
  - |-
    {{ ({'name': (redis_identifier + '.service'), 'priority': 750, 'groups': ['mash', 'redis']} if redis_enabled else omit) }}
  # /role-specific:redis

  # role-specific:keydb
  - |-
    {{ ({'name': (keydb_identifier + '.service'), 'priority': 750, 'groups': ['mash', 'keydb']} if keydb_enabled else omit) }}
  # /role-specific:keydb

  # role-specific:roundcube
  - |-
    {{ ({'name': (roundcube_identifier + '.service'), 'priority': 2000, 'groups': ['mash', 'roundcube']} if roundcube_enabled else omit) }}
  # /role-specific:roundcube

  # role-specific:rumqttd
  - |-
    {{ ({'name': (rumqttd_identifier + '.service'), 'priority': 2000, 'groups': ['mash', 'rumqttd']} if rumqttd_enabled else omit) }}
  # /role-specific:rumqttd

  # role-specific:semaphore
  - |-
    {{ ({'name': (semaphore_identifier + '.service'), 'priority': 2000, 'groups': ['mash', 'semaphore']} if semaphore_enabled else omit) }}
  # /role-specific:semaphore

  # role-specific:soft_serve
  - |-
    {{ ({'name': (soft_serve_identifier + '.service'), 'priority': 2000, 'groups': ['mash', 'soft-serve']} if soft_serve_enabled else omit) }}
  # /role-specific:soft_serve

  # role-specific:stirling_pdf
  - |-
    {{ ({'name': (stirling_pdf_identifier + '.service'), 'priority': 2000, 'groups': ['mash', 'stirling_pdf']} if stirling_pdf_enabled else omit) }}
  # /role-specific:stirling_pdf

  # role-specific:syncthing
  - |-
    {{ ({'name': (syncthing_identifier + '.service'), 'priority': 2000, 'groups': ['mash', 'syncthing']} if syncthing_enabled else omit) }}
  # /role-specific:syncthing

  # role-specific:tandoor
  - |-
    {{ ({'name': (tandoor_api_identifier + '.service'), 'priority': 2000, 'groups': ['mash', 'tandoor']} if tandoor_enabled else omit) }}
  - |-
    {{ ({'name': (tandoor_frontend_identifier + '.service'), 'priority': 2000, 'groups': ['mash', 'tandoor']} if tandoor_enabled else omit) }}
  # /role-specific:tandoor

  # role-specific:telegraf
  - |-
    {{ ({'name': (telegraf_identifier + '.service'), 'priority': 2000, 'groups': ['mash', 'telegraf']} if telegraf_enabled else omit) }}
  # /role-specific:telegraf

  # role-specific:vaultwarden
  - |-
    {{ ({'name': (vaultwarden_identifier + '.service'), 'priority': 2000, 'groups': ['mash', 'vaultwarden', 'vaultwarden-server']} if vaultwarden_enabled else omit) }}
  # /role-specific:vaultwarden

  # role-specific:uptime_kuma
  - |-
    {{ ({'name': (uptime_kuma_identifier + '.service'), 'priority': 2000, 'groups': ['mash', 'uptime-kuma']} if uptime_kuma_enabled else omit) }}
  # /role-specific:uptime_kuma

  # role-specific:wg_easy
  - |-
    {{ ({'name': (wg_easy_identifier + '.service'), 'priority': 2000, 'groups': ['mash', 'wg-easy']} if wg_easy_enabled else omit) }}
  # /role-specific:wg_easy

  # role-specific:wordpress
  - |-
    {{ ({'name': (wordpress_identifier + '.service'), 'priority': 2000, 'groups': ['mash', 'wordpress']} if wordpress_enabled else omit) }}
  # /role-specific:wordpress

  # role-specific:forgejo
  - |-
    {{ ({'name': (forgejo_identifier + '.service'), 'priority': 2000, 'groups': ['mash', 'forgejo', 'forgejo-server']} if forgejo_enabled else omit) }}
  # /role-specific:forgejo

  # role-specific:forgejo_runner
  - |-
    {{ ({'name': (forgejo_runner_identifier + '.service'), 'priority': 2000, 'groups': ['mash', 'forgejo-runner']} if forgejo_runner_enabled else omit) }}
  # /role-specific:forgejo_runner

  # role-specific:writefreely
  - |-
    {{ ({'name': (writefreely_identifier  + '.service'), 'priority': 2000, 'groups': ['mash', 'writefreely']} if writefreely_enabled else omit) }}
  # /role-specific:writefreely


devture_systemd_service_manager_services_list_auto: "{{ mash_playbook_devture_systemd_service_manager_services_list_auto_itemized | reject('equalto', omit) }}"

########################################################################
#                                                                      #
# /systemd_service_manager                                             #
#                                                                      #
########################################################################
# /role-specific:systemd_service_manager


# role-specific:postgres
########################################################################
#                                                                      #
# postgres                                                             #
#                                                                      #
########################################################################

devture_postgres_enabled: false

devture_postgres_identifier: "{{ mash_playbook_service_identifier_prefix }}postgres"

devture_postgres_architecture: "{{ mash_playbook_architecture }}"

devture_postgres_base_path: "{{ mash_playbook_base_path }}/{{ mash_playbook_service_base_directory_name_prefix }}postgres"

devture_postgres_uid: "{{ mash_playbook_uid }}"
devture_postgres_gid: "{{ mash_playbook_gid }}"

# This includes everything for maximum safety.
# It may not be optimal though, because some services may not be dependant on Postgres at all, etc.
devture_postgres_systemd_services_to_stop_for_maintenance_list_auto: "{{ devture_systemd_service_manager_services_list_auto | map(attribute='name') | reject('equalto', (devture_postgres_identifier + '.service')) }}"

mash_playbook_devture_postgres_managed_databases_auto_itemized:
  # Dummy entry, which is not role-specific.
  # Ensures there's at least one entry defined in the list.
  - "{{ omit }}"

  # role-specific:authelia
  - |-
    {{
      ({
        'name': authelia_config_storage_postgres_database,
        'username': authelia_config_storage_postgres_username,
        'password': authelia_config_storage_postgres_password,
      } if authelia_enabled and authelia_config_storage_postgres_host == devture_postgres_identifier else omit)
    }}
  # /role-specific:authelia

  # role-specific:authentik
  - |-
    {{
      ({
        'name': authentik_database_name,
        'username': authentik_database_username,
        'password': authentik_database_password,
      } if authentik_enabled and authentik_database_hostname == devture_postgres_identifier else omit)
    }}
  # /role-specific:authentik

  # role-specific:focalboard
  - |-
    {{
      ({
        'name': focalboard_database_name,
        'username': focalboard_database_username,
        'password': focalboard_database_password,
      } if focalboard_enabled and focalboard_database_type == 'postgres' and focalboard_database_hostname == devture_postgres_identifier else omit)
    }}
  # /role-specific:focalboard

  # role-specific:freshrss
  - |-
    {{
      ({
        'name': freshrss_database_name,
        'username': freshrss_database_username,
        'password': freshrss_database_password,
      } if freshrss_enabled and freshrss_database_hostname == devture_postgres_identifier else omit)
    }}
  # /role-specific:freshrss

  # role-specific:funkwhale
  - |-
    {{
      ({
        'name': funkwhale_database_name,
        'username': funkwhale_database_username,
        'password': funkwhale_database_password,
      } if funkwhale_enabled and funkwhale_database_hostname == devture_postgres_identifier else omit)
    }}
  # /role-specific:funkwhale

  # role-specific:gitea
  - |-
    {{
      ({
        'name': gitea_config_database_name,
        'username': gitea_config_database_username,
        'password': gitea_config_database_password,
      } if gitea_enabled else omit)
    }}
  # /role-specific:gitea

  # role-specific:healthchecks
  - |-
    {{
      ({
        'name': healthchecks_database_name,
        'username': healthchecks_database_username,
        'password': healthchecks_database_password,
      } if healthchecks_enabled and healthchecks_database_hostname == devture_postgres_identifier else omit)
    }}
  # /role-specific:healthchecks

  # role-specific:woodpecker_ci_server
  - |-
    {{
      ({
        'name': devture_woodpecker_ci_server_database_datasource_db_name,
        'username': devture_woodpecker_ci_server_database_datasource_username,
        'password': devture_woodpecker_ci_server_database_datasource_password,
      } if devture_woodpecker_ci_server_enabled else omit)
    }}
  # /role-specific:woodpecker_ci_server

  # role-specific:gotosocial
  - |-
    {{
      ({
        'name': gotosocial_database_name,
        'username': gotosocial_database_username,
        'password': gotosocial_database_password,
      } if gotosocial_enabled else omit)
    }}
  # /role-specific:gotosocial

  # role-specific:ilmo
  - |-
    {{
      ({
        'name': ilmo_database_name,
        'username': ilmo_database_username,
        'password': ilmo_database_password,
      } if ilmo_enabled else omit)
    }}
  # /role-specific:ilmo

  # role-specific:keycloak
  - |-
    {{
      ({
        'name': keycloak_database_name,
        'username': keycloak_database_username,
        'password': keycloak_database_password,
      } if keycloak_enabled and keycloak_database_type == 'postgres' and keycloak_database_hostname == devture_postgres_identifier else omit)
    }}
  # /role-specific:keycloak

  # role-specific:lago
  - |-
    {{
      ({
        'name': lago_database_name,
        'username': lago_database_username,
        'password': lago_database_password,
      } if lago_enabled and lago_database_hostname == devture_postgres_identifier else omit)
    }}
  # /role-specific:lago

  # role-specific:linkding
  - |-
    {{
      ({
        'name': linkding_database_name,
        'username': linkding_database_username,
        'password': linkding_database_password,
      } if linkding_enabled and linkding_database_engine == 'postgres' else omit)
    }}
  # /role-specific:linkding

  # role-specific:miniflux
  - |-
    {{
      ({
        'name': miniflux_database_name,
        'username': miniflux_database_username,
        'password': miniflux_database_password,
      } if miniflux_enabled else omit)
    }}
  # /role-specific:miniflux

  # role-specific:redmine
  - |-
    {{
      ({
        'name': redmine_database_name,
        'username': redmine_database_username,
        'password': redmine_database_password,
      } if redmine_enabled else omit)
    }}
  # /role-specific:redmine

  # role-specific:n8n
  - |-
    {{
      ({
        'name': n8n_database_name,
        'username': n8n_database_username,
        'password': n8n_database_password,
      } if n8n_enabled else omit)
    }}
  # /role-specific:n8n

  # role-specific:netbox
  - |-
    {{
      ({
        'name': netbox_database_name,
        'username': netbox_database_username,
        'password': netbox_database_password,
      } if netbox_enabled else omit)
    }}
  # /role-specific:netbox

  # role-specific:nextcloud
  - |-
    {{
      ({
        'name': nextcloud_database_name,
        'username': nextcloud_database_username,
        'password': nextcloud_database_password,
      } if nextcloud_enabled else omit)
    }}
  # /role-specific:nextcloud

  # role-specific:notfellchen
  - |-
    {{
      ({
        'name': notfellchen_database_name,
        'username': notfellchen_database_username,
        'password': notfellchen_database_password,
      } if notfellchen_enabled else omit)
    }}
  # /role-specific:notfellchen

  # role-specific:outline
  - |-
    {{
      ({
        'name': outline_database_name,
        'username': outline_database_username,
        'password': outline_database_password,
      } if outline_enabled and outline_database_hostname == devture_postgres_identifier else omit)
    }}
  # /role-specific:outline

  # role-specific:oxitraffic
  - |-
    {{
      ({
        'name': oxitraffic_database_name,
        'username': oxitraffic_database_username,
        'password': oxitraffic_database_password,
      } if oxitraffic_enabled and oxitraffic_database_hostname == devture_postgres_identifier else omit)
    }}
  # /role-specific:oxitraffic


  # role-specific:paperless
  - |-
    {{
      ({
        'name': paperless_database_name,
        'username': paperless_database_username,
        'password': paperless_database_password,
      } if paperless_enabled and paperless_database_hostname == devture_postgres_identifier else omit)
    }}
  # /role-specific:paperless

  # role-specific:peertube
  - |-
    {{
      ({
        'name': peertube_config_database_name,
        'username': peertube_config_database_username,
        'password': peertube_config_database_password,
      } if peertube_enabled else omit)
    }}
  # /role-specific:peertube

  # role-specific:plausible
  - |-
    {{
      ({
        'name': plausible_database_name,
        'username': plausible_database_username,
        'password': plausible_database_password,
      } if plausible_enabled else omit)
    }}
  # /role-specific:plausible

  # role-specific:prometheus_postgres_exporter
  - |-
    {{
      ({
        'name': prometheus_postgres_exporter_database_name,
        'username': prometheus_postgres_exporter_database_username,
        'password': prometheus_postgres_exporter_database_password,
      } if prometheus_postgres_exporter_enabled else omit)
    }}
  # /role-specific:prometheus_postgres_exporter

  # role-specific:firezone
  - |-
    {{
      ({
        'name': firezone_database_name,
        'username': firezone_database_username,
        'password': firezone_database_password,
      } if firezone_enabled else omit)
    }}
  # /role-specific:firezone

  # role-specific:vaultwarden
  - |-
    {{
      ({
        'name': vaultwarden_database_name,
        'username': vaultwarden_database_username,
        'password': vaultwarden_database_password,
      } if vaultwarden_enabled else omit)
    }}
  # /role-specific:vaultwarden

  # role-specific:forgejo
  - |-
    {{
      ({
        'name': forgejo_config_database_name,
        'username': forgejo_config_database_username,
        'password': forgejo_config_database_password,
      } if forgejo_enabled else omit)
    }}
  # /role-specific:forgejo

  # role-specific:roundcube
  - |-
    {{
      ({
        'name': roundcube_database_name,
        'username': roundcube_database_username,
        'password': roundcube_database_password,
      } if roundcube_enabled and roundcube_database_hostname == devture_postgres_identifier else omit)
    }}
  # /role-specific:roundcube

  # role-specific:semaphore
  - |-
    {{
      ({
        'name': semaphore_database_name,
        'username': semaphore_database_username,
        'password': semaphore_database_password,
      } if semaphore_enabled and semaphore_database_host == devture_postgres_identifier else omit)
    }}
  # /role-specific:semaphore

  # role-specific:tandoor
  - |-
    {{
      ({
        'name': tandoor_database_name,
        'username': tandoor_database_username,
        'password': tandoor_database_password,
      } if tandoor_enabled and tandoor_database_hostname == devture_postgres_identifier else omit)
    }}
  # /role-specific:tandoor

devture_postgres_managed_databases_auto: "{{ mash_playbook_devture_postgres_managed_databases_auto_itemized | reject('equalto', omit) }}"

########################################################################
#                                                                      #
# /postgres                                                            #
#                                                                      #
########################################################################
# /role-specific:postgres


# role-specific:postgres_backup
########################################################################
#                                                                      #
# postgres_backup                                                      #
#                                                                      #
########################################################################

devture_postgres_backup_enabled: false

devture_postgres_backup_postgres_role_include_name: galaxy/postgres

devture_postgres_backup_identifier: "{{ mash_playbook_service_identifier_prefix }}postgres-backup"

devture_postgres_backup_architecture: "{{ mash_playbook_architecture }}"

devture_postgres_backup_base_path: "{{ mash_playbook_base_path }}/{{ mash_playbook_service_base_directory_name_prefix }}postgres-backup"

devture_postgres_backup_uid: "{{ mash_playbook_uid }}"
devture_postgres_backup_gid: "{{ mash_playbook_gid }}"

# role-specific:postgres
devture_postgres_backup_systemd_required_services_list_auto: |
  {{
    ([(devture_postgres_identifier + '.service')] if (devture_postgres_enabled and devture_postgres_backup_connection_hostname == devture_postgres_connection_hostname) else [])
  }}

devture_postgres_backup_container_network: "{{ (devture_postgres_container_network if (devture_postgres_enabled and devture_postgres_backup_connection_hostname == devture_postgres_connection_hostname) else devture_postgres_backup_identifier) }}"

devture_postgres_backup_container_additional_networks_auto: |-
  {{
      ([devture_postgres_container_network] if (devture_postgres_enabled and devture_postgres_backup_connection_hostname == devture_postgres_connection_hostname and devture_postgres_backup_container_network != devture_postgres_container_network) else [])
  }}

devture_postgres_backup_connection_hostname: "{{ devture_postgres_connection_hostname if devture_postgres_enabled else '' }}"
devture_postgres_backup_connection_port: "{{ devture_postgres_connection_port if devture_postgres_enabled else 5432 }}"
devture_postgres_backup_connection_username: "{{ devture_postgres_connection_username if devture_postgres_enabled else '' }}"
devture_postgres_backup_connection_password: "{{ devture_postgres_connection_password if devture_postgres_enabled else '' }}"

devture_postgres_backup_postgres_data_path: "{{ devture_postgres_data_path if devture_postgres_enabled else '' }}"

devture_postgres_backup_databases: "{{ devture_postgres_managed_databases | map(attribute='name') if devture_postgres_enabled else [] }}"
# /role-specific:postgres

########################################################################
#                                                                      #
# /postgres_backup                                                     #
#                                                                      #
########################################################################
# /role-specific:postgres_backup


# role-specific:playbook_state_preserver
########################################################################
#                                                                      #
# playbook_state_preserver                                             #
#                                                                      #
########################################################################

# To completely disable this feature, use `devture_playbook_state_preserver_enabled: false`.

devture_playbook_state_preserver_uid: "{{ mash_playbook_uid }}"
devture_playbook_state_preserver_gid: "{{ mash_playbook_gid }}"

devture_playbook_state_preserver_vars_preservation_dst: "{{ mash_playbook_base_path }}/{{ mash_playbook_service_base_directory_name_prefix }}vars.yml"

devture_playbook_state_preserver_commit_hash_preservation_dst: "{{ mash_playbook_base_path }}/{{ mash_playbook_service_base_directory_name_prefix }}git_hash.yml"

########################################################################
#                                                                      #
# /playbook_state_preserver                                            #
#                                                                      #
########################################################################
# /role-specific:playbook_state_preserver



########################################################################
#                                                                      #
# geerlingguy/ansible-role-docker                                      #
#                                                                      #
########################################################################

docker_daemon_options: "{{ mash_playbook_docker_installation_daemon_options }}"

########################################################################
#                                                                      #
# /geerlingguy/ansible-role-docker                                     #
#                                                                      #
########################################################################



# role-specific:container_socket_proxy
########################################################################
#                                                                      #
# container_socket_proxy                                               #
#                                                                      #
########################################################################

devture_container_socket_proxy_enabled: "{{ devture_traefik_enabled }}"

devture_container_socket_proxy_identifier: "{{ mash_playbook_service_identifier_prefix }}container-socket-proxy"

devture_container_socket_proxy_base_path: "{{ mash_playbook_base_path }}/{{ mash_playbook_service_base_directory_name_prefix }}container-socket-proxy"

devture_container_socket_proxy_uid: "{{ mash_playbook_uid }}"
devture_container_socket_proxy_gid: "{{ mash_playbook_gid }}"

# Traefik requires read access to the containers APIs to do its job
devture_container_socket_proxy_api_containers_enabled: true

########################################################################
#                                                                      #
# /container_socket_proxy                                              #
#                                                                      #
########################################################################
# /role-specific:container_socket_proxy



# role-specific:traefik
########################################################################
#                                                                      #
# traefik                                                              #
#                                                                      #
########################################################################

devture_traefik_enabled: "{{ mash_playbook_reverse_proxy_type == 'playbook-managed-traefik' }}"

devture_traefik_identifier: "{{ mash_playbook_service_identifier_prefix }}traefik"

devture_traefik_base_path: "{{ mash_playbook_base_path }}/{{ mash_playbook_service_base_directory_name_prefix }}traefik"

devture_traefik_uid: "{{ mash_playbook_uid }}"
devture_traefik_gid: "{{ mash_playbook_gid }}"

# role-specific:container_socket_proxy
devture_traefik_config_providers_docker_endpoint: "{{ devture_container_socket_proxy_endpoint if devture_container_socket_proxy_enabled else 'unix:///var/run/docker.sock' }}"
# /role-specific:container_socket_proxy

devture_traefik_container_additional_networks_auto: |
  {{
    ([devture_container_socket_proxy_container_network] if devture_container_socket_proxy_enabled | default(false) else [])
  }}

devture_traefik_systemd_required_services_list: |
  {{
    ([devture_systemd_docker_base_docker_service_name] if devture_systemd_docker_base_docker_service_name else [])
    +
    ([devture_container_socket_proxy_identifier + '.service'] if devture_container_socket_proxy_enabled | default(false) else [])
  }}

########################################################################
#                                                                      #
# /traefik                                                             #
#                                                                      #
########################################################################
# /role-specific:traefik



# role-specific:docker_sdk_for_python
########################################################################
#                                                                      #
# docker_sdk_for_python                                                #
#                                                                      #
########################################################################

devture_docker_sdk_for_python_installation_enabled: false

########################################################################
#                                                                      #
# /docker_sdk_for_python                                               #
#                                                                      #
########################################################################
# /role-specific:docker_sdk_for_python



# role-specific:timesync
########################################################################
#                                                                      #
# timesync                                                             #
#                                                                      #
########################################################################

# To completely disable installing systemd-timesyncd/ntpd, use `devture_timesync_installation_enabled: false`.

devture_timesync_installation_enabled: false

########################################################################
#                                                                      #
# /timesync                                                            #
#                                                                      #
########################################################################
# /role-specific:timesync



# role-specific:adguard_home
########################################################################
#                                                                      #
# adguard-home                                                         #
#                                                                      #
########################################################################

adguard_home_enabled: false

adguard_home_identifier: "{{ mash_playbook_service_identifier_prefix }}adguard-home"

adguard_home_uid: "{{ mash_playbook_uid }}"
adguard_home_gid: "{{ mash_playbook_gid }}"

adguard_home_base_path: "{{ mash_playbook_base_path }}/{{ mash_playbook_service_base_directory_name_prefix }}adguard-home"

adguard_home_container_additional_networks: |
  {{
    ([mash_playbook_reverse_proxyable_services_additional_network] if mash_playbook_reverse_proxyable_services_additional_network else [])
  }}

adguard_home_container_labels_traefik_enabled: "{{ mash_playbook_traefik_labels_enabled }}"
adguard_home_container_labels_traefik_docker_network: "{{ mash_playbook_reverse_proxyable_services_additional_network }}"

# role-specific:traefik
adguard_home_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
adguard_home_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}"
# /role-specific:traefik

########################################################################
#                                                                      #
# /adguard-home                                                        #
#                                                                      #
########################################################################
# /role-specific:adguard_home



# role-specific:apisix_dashboard
########################################################################
#                                                                      #
# apisix_dashboard                                                       #
#                                                                      #
########################################################################

apisix_dashboard_enabled: false

apisix_dashboard_identifier: "{{ mash_playbook_service_identifier_prefix }}apisix-dashboard"

apisix_dashboard_uid: "{{ mash_playbook_uid }}"
apisix_dashboard_gid: "{{ mash_playbook_gid }}"

apisix_dashboard_base_path: "{{ mash_playbook_base_path }}/{{ mash_playbook_service_base_directory_name_prefix }}apisix-dashboard"

apisix_dashboard_container_additional_networks_auto: |
  {{
    ([mash_playbook_reverse_proxyable_services_additional_network] if (mash_playbook_reverse_proxyable_services_additional_network and apisix_dashboard_container_labels_traefik_enabled) else [])
  }}

apisix_dashboard_container_labels_traefik_enabled: "{{ mash_playbook_traefik_labels_enabled }}"
apisix_dashboard_container_labels_traefik_docker_network: "{{ mash_playbook_reverse_proxyable_services_additional_network }}"
apisix_dashboard_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
apisix_dashboard_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}"

# role-specific:etcd
apisix_dashboard_config_conf_etcd_endpoints: |
  {{
    ([(etcd_identifier + ':2379')] if etcd_enabled else [])
  }}

apisix_dashboard_config_conf_etcd_username: "{{ ('root' if (etcd_enabled and not etcd_environment_variable_allow_none_authentication) else '') }}"
apisix_dashboard_config_conf_etcd_password: "{{ (etcd_environment_variable_etcd_root_password if (etcd_enabled and not etcd_environment_variable_allow_none_authentication) else '') }}"

apisix_dashboard_container_additional_networks_custom: |
  {{
    ([etcd_container_network] if etcd_enabled else [])
  }}

apisix_dashboard_systemd_required_systemd_services_list_auto: |
  {{
    ([(etcd_identifier + '.service')] if etcd_enabled else [])
  }}
# /role-specific:etcd

########################################################################
#                                                                      #
# /apisix_dashboard                                                      #
#                                                                      #
########################################################################
# /role-specific:apisix_dashboard



# role-specific:apisix_gateway
########################################################################
#                                                                      #
# apisix_gateway                                                       #
#                                                                      #
########################################################################

apisix_gateway_enabled: false

apisix_gateway_identifier: "{{ mash_playbook_service_identifier_prefix }}apisix-gateway"

apisix_gateway_uid: "{{ mash_playbook_uid }}"
apisix_gateway_gid: "{{ mash_playbook_gid }}"

apisix_gateway_base_path: "{{ mash_playbook_base_path }}/{{ mash_playbook_service_base_directory_name_prefix }}apisix-gateway"

apisix_gateway_container_additional_networks_auto: |
  {{
    ([mash_playbook_reverse_proxyable_services_additional_network] if (mash_playbook_reverse_proxyable_services_additional_network and apisix_gateway_container_labels_traefik_enabled) else [])
  }}

apisix_gateway_container_labels_traefik_enabled: "{{ mash_playbook_traefik_labels_enabled }}"
apisix_gateway_container_labels_traefik_docker_network: "{{ mash_playbook_reverse_proxyable_services_additional_network }}"
apisix_gateway_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
apisix_gateway_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}"

apisix_gateway_container_labels_metrics_enabled: "{{ prometheus_enabled | default(false) or mash_playbook_metrics_exposure_enabled }}"
apisix_gateway_container_labels_metrics_hostname: "{{ mash_playbook_metrics_exposure_hostname }}"
apisix_gateway_container_labels_metrics_path_prefix: "{{ mash_playbook_metrics_exposure_path_prefix }}/{{ apisix_gateway_identifier }}"
apisix_gateway_container_labels_metrics_middleware_basic_auth_enabled: "{{ mash_playbook_metrics_exposure_http_basic_auth_enabled }}"
apisix_gateway_container_labels_metrics_middleware_basic_auth_users: "{{ mash_playbook_metrics_exposure_http_basic_auth_users }}"

# role-specific:etcd
apisix_gateway_config_deployment_etcd_host: |
  {{
    ([('http://' + etcd_identifier + ':2379')] if etcd_enabled else [])
  }}

apisix_gateway_config_deployment_etcd_user: "{{ ('root' if (etcd_enabled and not etcd_environment_variable_allow_none_authentication) else '') }}"
apisix_gateway_config_deployment_etcd_password: "{{ (etcd_environment_variable_etcd_root_password if (etcd_enabled and not etcd_environment_variable_allow_none_authentication) else '') }}"

apisix_gateway_container_additional_networks_custom: |
  {{
    ([etcd_container_network] if etcd_enabled else [])
  }}

apisix_gateway_systemd_required_systemd_services_list_auto: |
  {{
    ([(etcd_identifier + '.service')] if etcd_enabled else [])
  }}
# /role-specific:etcd

########################################################################
#                                                                      #
# /apisix_gateway                                                      #
#                                                                      #
########################################################################
# /role-specific:apisix_gateway



# role-specific:appsmith
########################################################################
#                                                                      #
# appsmith                                                             #
#                                                                      #
########################################################################

appsmith_enabled: false

appsmith_identifier: "{{ mash_playbook_service_identifier_prefix }}appsmith"

appsmith_uid: "{{ mash_playbook_uid }}"
appsmith_gid: "{{ mash_playbook_gid }}"

appsmith_base_path: "{{ mash_playbook_base_path }}/{{ mash_playbook_service_base_directory_name_prefix }}appsmith"

appsmith_container_additional_networks_auto: |
  {{
    ([mash_playbook_reverse_proxyable_services_additional_network] if mash_playbook_reverse_proxyable_services_additional_network else [])
  }}

appsmith_container_labels_traefik_enabled: "{{ mash_playbook_traefik_labels_enabled }}"
appsmith_container_labels_traefik_docker_network: "{{ mash_playbook_reverse_proxyable_services_additional_network }}"

# role-specific:traefik
appsmith_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
appsmith_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}"
# /role-specific:traefik

########################################################################
#                                                                      #
# /appsmith                                                            #
#                                                                      #
########################################################################
# /role-specific:appsmith



# role-specific:authentik
########################################################################
#                                                                      #
# authentik                                                            #
#                                                                      #
########################################################################

authentik_enabled: false

authentik_identifier: "{{ mash_playbook_service_identifier_prefix }}authentik"

authentik_base_path: "{{ mash_playbook_base_path }}/{{ mash_playbook_service_base_directory_name_prefix }}authentik"

authentik_uid: "{{ mash_playbook_uid }}"
authentik_gid: "{{ mash_playbook_gid }}"

# role-specific:postgres
authentik_database_hostname: "{{ devture_postgres_identifier if devture_postgres_enabled else '' }}"
authentik_database_port: "{{ '5432' if devture_postgres_enabled else '' }}"
authentik_database_password: "{{ '%s' | format(mash_playbook_generic_secret_key) | password_hash('sha512', 'db.authentik', rounds=655555) | to_uuid }}"
authentik_database_username: "{{ authentik_identifier }}"
# /role-specific:postgres

authentik_server_systemd_required_services_list_auto: |
  {{
    ([devture_postgres_identifier ~ '.service'] if devture_postgres_enabled and authentik_database_hostname == devture_postgres_identifier else [])
  }}

authentik_container_additional_networks_auto: |
  {{
    ([mash_playbook_reverse_proxyable_services_additional_network] if mash_playbook_reverse_proxyable_services_additional_network else [])
    +
    ([devture_postgres_container_network] if devture_postgres_enabled and authentik_database_hostname == devture_postgres_identifier and authentik_container_network != devture_postgres_container_network else [])
  }}

authentik_container_labels_traefik_enabled: "{{ mash_playbook_traefik_labels_enabled }}"
authentik_container_labels_traefik_docker_network: "{{ mash_playbook_reverse_proxyable_services_additional_network }}"

# role-specific:traefik
authentik_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
authentik_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}"
# /role-specific:traefik

########################################################################
#                                                                      #
# /authentik                                                           #
#                                                                      #
########################################################################
# /role-specific:authentik



# role-specific:backup_borg
########################################################################
#                                                                      #
# backup-borg                                                          #
#                                                                      #
########################################################################

backup_borg_enabled: false

backup_borg_identifier: "{{ mash_playbook_service_identifier_prefix }}backup-borg"

backup_borg_base_path: "{{ mash_playbook_base_path }}/{{ mash_playbook_service_base_directory_name_prefix }}borg-backup"

backup_borg_uid: "{{ mash_playbook_uid }}"
backup_borg_gid: "{{ mash_playbook_gid }}"

backup_borg_container_network: "{{ devture_postgres_container_network if devture_postgres_enabled else backup_borg_identifier }}"

backup_borg_retention_prefix: "{{ mash_playbook_service_identifier_prefix }}"
backup_borg_storage_archive_name_format: "{{ mash_playbook_service_identifier_prefix }}-{now:%Y-%m-%d-%H%M%S}"

backup_borg_container_image_self_build: "{{ mash_playbook_architecture not in ['amd64', 'arm32', 'arm64'] }}"

# role-specific:postgres
backup_borg_postgresql_enabled: "{{ devture_postgres_enabled }}"
backup_borg_postgresql_databases_hostname: "{{ devture_postgres_connection_hostname if devture_postgres_enabled else '' }}"
backup_borg_postgresql_databases_username: "{{ devture_postgres_connection_username if devture_postgres_enabled else '' }}"
backup_borg_postgresql_databases_password: "{{ devture_postgres_connection_password if devture_postgres_enabled else '' }}"
backup_borg_postgresql_databases_port: "{{ devture_postgres_connection_port if devture_postgres_enabled else 5432 }}"
backup_borg_postgresql_databases: "{{ devture_postgres_managed_databases | map(attribute='name') if devture_postgres_enabled else [] }}"
# /role-specific:postgres

# role-specific:mariadb
backup_borg_mysql_enabled: "{{ mariadb_enabled }}"
backup_borg_mysql_databases_hostname: "{{ mariadb_identifier if mariadb_enabled else '' }}"
backup_borg_mysql_databases_username: "root"
backup_borg_mysql_databases_password: "{{ mariadb_root_passsword if mariadb_enabled else '' }}"
backup_borg_mysql_databases_port: 3306
backup_borg_mysql_databases: "{{ mariadb_managed_databases | map(attribute='name') if mariadb_enabled else [] }}"
# /role-specific:mariadb

backup_borg_location_source_directories:
  - "{{ mash_playbook_base_path }}"

backup_borg_location_exclude_patterns: |
  {{
    ([devture_postgres_data_path] if devture_postgres_enabled | default(false) else [])
    +
    ([mariadb_data_path] if mariadb_enabled | default(false) else [])
  }}

backup_borg_systemd_required_services_list: |
  {{
    ([devture_systemd_docker_base_docker_service_name] if devture_systemd_docker_base_docker_service_name else [])
    +
    ([devture_postgres_identifier ~ '.service'] if devture_postgres_enabled | default(false) else [])
    +
    ([mariadb_identifier ~ '.service'] if mariadb_enabled | default(false) else [])
  }}

########################################################################
#                                                                      #
# /backup-borg                                                         #
#                                                                      #
########################################################################
# /role-specific:backup_borg



# role-specific:changedetection
########################################################################
#                                                                      #
# Changedetection.io                                                   #
#                                                                      #
########################################################################

changedetection_enabled: false

changedetection_identifier: "{{ mash_playbook_service_identifier_prefix }}changedetection"

changedetection_base_path: "{{ mash_playbook_base_path }}/{{ mash_playbook_service_base_directory_name_prefix }}changedetection"

changedetection_uid: "{{ mash_playbook_uid }}"
changedetection_gid: "{{ mash_playbook_gid }}"

changedetection_container_additional_networks_auto: |
  {{
    ([mash_playbook_reverse_proxyable_services_additional_network] if mash_playbook_reverse_proxyable_services_additional_network else [])
  }}

changedetection_container_labels_traefik_enabled: "{{ mash_playbook_traefik_labels_enabled }}"
changedetection_container_labels_traefik_docker_network: "{{ mash_playbook_reverse_proxyable_services_additional_network }}"

# role-specific:traefik
changedetection_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
changedetection_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}"
# /role-specific:traefik

########################################################################
#                                                                      #
# /Changedetection.io                                                  #
#                                                                      #
########################################################################
# /role-specific:changedetection



# role-specific:wetty
########################################################################
#                                                                      #
# wetty                                                                #
#                                                                      #
########################################################################

wetty_enabled: false

wetty_identifier: "{{ mash_playbook_service_identifier_prefix }}wetty"

wetty_base_path: "{{ mash_playbook_base_path }}/{{ mash_playbook_service_base_directory_name_prefix }}wetty"

wetty_uid: "{{ mash_playbook_uid }}"
wetty_gid: "{{ mash_playbook_gid }}"

wetty_container_additional_networks_auto: |
  {{
    ([mash_playbook_reverse_proxyable_services_additional_network] if mash_playbook_reverse_proxyable_services_additional_network else [])
  }}

wetty_container_labels_traefik_enabled: "{{ mash_playbook_traefik_labels_enabled }}"
wetty_container_labels_traefik_docker_network: "{{ mash_playbook_reverse_proxyable_services_additional_network }}"

# role-specific:traefik
wetty_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
wetty_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}"
# /role-specific:traefik

########################################################################
#                                                                      #
# /wetty                                                               #
#                                                                      #
########################################################################
# /role-specific:wetty



# role-specific:calibre-web
########################################################################
#                                                                      #
# calibre-web                                                            #
#                                                                      #
########################################################################

calibre_web_enabled: false

calibre_web_identifier: "{{ mash_playbook_service_identifier_prefix }}calibre-web"

calibre_web_uid: "{{ mash_playbook_uid }}"
calibre_web_gid: "{{ mash_playbook_gid }}"

calibre_web_base_path: "{{ mash_playbook_base_path }}/{{ mash_playbook_service_base_directory_name_prefix }}calibre-web"

calibre_web_container_additional_networks_auto: |
  {{
    ([mash_playbook_reverse_proxyable_services_additional_network] if mash_playbook_reverse_proxyable_services_additional_network else [])
  }}

calibre_web_container_labels_traefik_enabled: "{{ mash_playbook_traefik_labels_enabled }}"
calibre_web_container_labels_traefik_docker_network: "{{ mash_playbook_reverse_proxyable_services_additional_network }}"
calibre_web_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
calibre_web_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}"

########################################################################
#                                                                      #
# /calibre-web                                                           #
#                                                                      #
########################################################################
# /role-specific:calibre-web



# role-specific:readeck
########################################################################
#                                                                      #
# readeck                                                            #
#                                                                      #
########################################################################

readeck_enabled: false

readeck_identifier: "{{ mash_playbook_service_identifier_prefix }}readeck"

readeck_uid: "{{ mash_playbook_uid }}"
readeck_gid: "{{ mash_playbook_gid }}"

readeck_base_path: "{{ mash_playbook_base_path }}/{{ mash_playbook_service_base_directory_name_prefix }}readeck"

readeck_container_additional_networks_auto: |
  {{
    ([mash_playbook_reverse_proxyable_services_additional_network] if mash_playbook_reverse_proxyable_services_additional_network else [])
  }}

readeck_container_labels_traefik_enabled: "{{ mash_playbook_traefik_labels_enabled }}"
readeck_container_labels_traefik_docker_network: "{{ mash_playbook_reverse_proxyable_services_additional_network }}"
readeck_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
readeck_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}"

########################################################################
#                                                                      #
# /readeck                                                           #
#                                                                      #
########################################################################
# /role-specific:readeck



# role-specific:clickhouse
########################################################################
#                                                                      #
# clickhouse                                                           #
#                                                                      #
########################################################################

clickhouse_enabled: false

clickhouse_identifier: "{{ mash_playbook_service_identifier_prefix }}clickhouse"

clickhouse_base_path: "{{ mash_playbook_base_path }}/{{ mash_playbook_service_base_directory_name_prefix }}clickhouse"

clickhouse_uid: "{{ mash_playbook_uid }}"
clickhouse_gid: "{{ mash_playbook_gid }}"

clickhouse_managed_databases_auto_itemized:
  # Dummy entry, which is not role-specific.
  # Ensures there's at least one entry defined in the list.
  - "{{ omit }}"

  # role-specific:plausible
  - |-
    {{
      ({
        'name': plausible_clickhouse_database_name,
        'username': plausible_clickhouse_database_username,
        'password': plausible_clickhouse_database_password,
        'additional_sql': ('GRANT SELECT ON system.replicas TO ' + plausible_clickhouse_database_username + '; GRANT SELECT ON system.parts TO ' + plausible_clickhouse_database_username + ';')
      } if plausible_enabled and plausible_clickhouse_database_hostname == clickhouse_identifier else omit)
    }}
  # /role-specific:plausible

clickhouse_managed_databases_auto: "{{ clickhouse_managed_databases_auto_itemized | reject('equalto', omit) }}"

########################################################################
#                                                                      #
# /clickhouse                                                          #
#                                                                      #
########################################################################
# /role-specific:clickhouse



# role-specific:collabora_online
########################################################################
#                                                                      #
# collabora-online                                                     #
#                                                                      #
########################################################################

collabora_online_enabled: false

collabora_online_identifier: "{{ mash_playbook_service_identifier_prefix }}collabora-online"

collabora_online_base_path: "{{ mash_playbook_base_path }}/{{ mash_playbook_service_base_directory_name_prefix }}collabora-online"

collabora_online_uid: "{{ mash_playbook_uid }}"
collabora_online_gid: "{{ mash_playbook_gid }}"

collabora_online_container_additional_networks: |
  {{
    ([mash_playbook_reverse_proxyable_services_additional_network] if mash_playbook_reverse_proxyable_services_additional_network else [])
  }}

collabora_online_container_labels_traefik_enabled: "{{ mash_playbook_traefik_labels_enabled }}"
collabora_online_container_labels_traefik_docker_network: "{{ mash_playbook_reverse_proxyable_services_additional_network }}"

# role-specific:traefik
collabora_online_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
collabora_online_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}"
# /role-specific:traefik

########################################################################
#                                                                      #
# /collabora-online                                                    #
#                                                                      #
########################################################################
# /role-specific:collabora_online



# role-specific:couchdb
########################################################################
#                                                                      #
# couchdb                                                              #
#                                                                      #
########################################################################
couchdb_enabled: false

couchdb_identifier: "{{ mash_playbook_service_identifier_prefix }}couchdb"

couchdb_base_path: "{{ mash_playbook_base_path }}/{{ mash_playbook_service_base_directory_name_prefix }}couchdb"

couchdb_uid: "5984"
couchdb_gid: "5984"

couchdb_admin_user: "{{ mash_playbook_service_identifier_prefix }}admin"
couchdb_admin_passwd: "{{ '%s' | format(mash_playbook_generic_secret_key) | password_hash('sha512', 'db.couchdb', rounds=655555) | to_uuid }}"
couchdb_config_uuid: "{{ '%s' | format(mash_playbook_generic_secret_key) | password_hash('sha512', 'uuid.couchdb', rounds=655555) | to_uuid }}"

couchdb_config_couch_chttpd_auth_secret: "{{ '%s' | format(mash_playbook_generic_secret_key) | password_hash('sha512', 'secret.couchdb', rounds=655555) | to_uuid }}"

########################################################################
#                                                                      #
# /couchdb                                                             #
#                                                                      #
########################################################################
# /role-specific:couchdb



# role-specific:docker_registry
########################################################################
#                                                                      #
# docker-registry                                                      #
#                                                                      #
########################################################################

docker_registry_enabled: false

docker_registry_identifier: "{{ mash_playbook_service_identifier_prefix }}docker-registry"

docker_registry_base_path: "{{ mash_playbook_base_path }}/{{ mash_playbook_service_base_directory_name_prefix }}docker-registry"

docker_registry_uid: "{{ mash_playbook_uid }}"
docker_registry_gid: "{{ mash_playbook_gid }}"

docker_registry_container_additional_networks: |
  {{
    ([mash_playbook_reverse_proxyable_services_additional_network] if mash_playbook_reverse_proxyable_services_additional_network else [])
  }}

docker_registry_container_labels_traefik_enabled: "{{ mash_playbook_traefik_labels_enabled }}"
docker_registry_container_labels_traefik_docker_network: "{{ mash_playbook_reverse_proxyable_services_additional_network }}"

# role-specific:traefik
docker_registry_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
docker_registry_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}"
# /role-specific:traefik

########################################################################
#                                                                      #
# /docker-registry                                                     #
#                                                                      #
########################################################################
# /role-specific:docker_registry



# role-specific:docker_registry_proxy
########################################################################
#                                                                      #
# docker-registry-proxy                                              #
#                                                                      #
########################################################################

docker_registry_proxy_enabled: false

docker_registry_proxy_identifier: "{{ mash_playbook_service_identifier_prefix }}docker-registry-proxy"

docker_registry_proxy_base_path: "{{ mash_playbook_base_path }}/{{ mash_playbook_service_base_directory_name_prefix }}docker-registry-proxy"

docker_registry_proxy_uid: "{{ mash_playbook_uid }}"
docker_registry_proxy_gid: "{{ mash_playbook_gid }}"

docker_registry_proxy_target_scheme: "{{ 'http' if docker_registry_enabled else '' }}"
docker_registry_proxy_target_host: "{{ docker_registry_identifier+':5000' if docker_registry_enabled else '' }}"

docker_registry_proxy_container_additional_networks: |
  {{
    ([mash_playbook_reverse_proxyable_services_additional_network] if mash_playbook_reverse_proxyable_services_additional_network else [])
  }}

docker_registry_proxy_container_labels_traefik_enabled: "{{ mash_playbook_traefik_labels_enabled }}"
docker_registry_proxy_container_labels_traefik_docker_network: "{{ mash_playbook_reverse_proxyable_services_additional_network }}"

# role-specific:traefik
docker_registry_proxy_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
docker_registry_proxy_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}"
# /role-specific:traefik

########################################################################
#                                                                      #
# /docker-registry-proxy                                             #
#                                                                      #
########################################################################
# /role-specific:docker_registry_proxy



# role-specific:docker_registry_browser
########################################################################
#                                                                      #
# docker-registry-browser                                              #
#                                                                      #
########################################################################

docker_registry_browser_enabled: false

docker_registry_browser_identifier: "{{ mash_playbook_service_identifier_prefix }}docker-registry-browser"

docker_registry_browser_base_path: "{{ mash_playbook_base_path }}/{{ mash_playbook_service_base_directory_name_prefix }}docker-registry-browser"

docker_registry_browser_uid: "{{ mash_playbook_uid }}"
docker_registry_browser_gid: "{{ mash_playbook_gid }}"

docker_registry_browser_secret_key_base: "{{ '%s' | format(mash_playbook_generic_secret_key) | password_hash('sha512', 'browser', rounds=655555) }}"

docker_registry_browser_container_additional_networks: |
  {{
    ([mash_playbook_reverse_proxyable_services_additional_network] if mash_playbook_reverse_proxyable_services_additional_network else [])
  }}

docker_registry_browser_container_labels_traefik_enabled: "{{ mash_playbook_traefik_labels_enabled }}"
docker_registry_browser_container_labels_traefik_docker_network: "{{ mash_playbook_reverse_proxyable_services_additional_network }}"

# role-specific:traefik
docker_registry_browser_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
docker_registry_browser_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}"
# /role-specific:traefik

########################################################################
#                                                                      #
# /docker-registry-browser                                             #
#                                                                      #
########################################################################
# /role-specific:docker_registry_browser


# role-specific:docker_registry_purger
########################################################################
#                                                                      #
# docker-registry-purger                                               #
#                                                                      #
########################################################################

docker_registry_purger_enabled: false

docker_registry_purger_identifier: "{{ mash_playbook_service_identifier_prefix }}docker-registry-purger"

docker_registry_purger_base_path: "{{ mash_playbook_base_path }}/{{ mash_playbook_service_base_directory_name_prefix }}docker-registry-purger"

docker_registry_purger_uid: "{{ mash_playbook_uid }}"
docker_registry_purger_gid: "{{ mash_playbook_gid }}"

########################################################################
#                                                                      #
# /docker-registry-purger                                              #
#                                                                      #
########################################################################
# /role-specific:docker_registry_purger


# role-specific:echoip
########################################################################
#                                                                      #
# echoip                                                               #
#                                                                      #
########################################################################

echoip_enabled: false

echoip_identifier: "{{ mash_playbook_service_identifier_prefix }}echoip"

echoip_base_path: "{{ mash_playbook_base_path }}/{{ mash_playbook_service_base_directory_name_prefix }}echoip"

echoip_uid: "{{ mash_playbook_uid }}"
echoip_gid: "{{ mash_playbook_gid }}"

echoip_systemd_required_services_list: |
  {{
    ([devture_systemd_docker_base_docker_service_name] if devture_systemd_docker_base_docker_service_name else [])
  }}

echoip_container_additional_networks: |
  {{
    ([mash_playbook_reverse_proxyable_services_additional_network] if mash_playbook_reverse_proxyable_services_additional_network else [])
  }}

echoip_container_labels_traefik_enabled: "{{ mash_playbook_traefik_labels_enabled }}"
echoip_container_labels_traefik_docker_network: "{{ mash_playbook_reverse_proxyable_services_additional_network }}"

# role-specific:traefik
echoip_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
echoip_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}"
# /role-specific:traefik

########################################################################
#                                                                      #
# /echoip                                                              #
#                                                                      #
########################################################################
# /role-specific:echoip


# role-specific:endlessh
########################################################################
#                                                                      #
# endlessh                                                             #
#                                                                      #
########################################################################

endlessh_enabled: false
endlessh_hostname: "{{ mash_playbook_metrics_exposure_hostname }}"
endlessh_path_prefix: "{{ mash_playbook_metrics_exposure_path_prefix }}/{{ endlessh_identifier }}"
endlessh_identifier: "{{ mash_playbook_service_identifier_prefix }}endlessh"
endlessh_base_path: "{{ mash_playbook_base_path }}/{{ mash_playbook_service_base_directory_name_prefix }}endlessh"
endlessh_uid: "{{ mash_playbook_uid }}"
endlessh_gid: "{{ mash_playbook_gid }}"

endlessh_container_additional_networks_auto: |
  {{
    ([mash_playbook_reverse_proxyable_services_additional_network] if mash_playbook_reverse_proxyable_services_additional_network else [])
  }}


# Only enable Traefik labels if a hostname is set (indicating that this will be exposed publicly)
endlessh_container_labels_traefik_enabled: "{{ mash_playbook_traefik_labels_enabled and endlessh_hostname }}"
endlessh_container_labels_traefik_docker_network: "{{ mash_playbook_reverse_proxyable_services_additional_network }}"
endlessh_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
endlessh_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}"

endlessh_container_labels_metrics_middleware_basic_auth_enabled: "{{ mash_playbook_metrics_exposure_http_basic_auth_enabled }}"
endlessh_container_labels_metrics_middleware_basic_auth_users: "{{ mash_playbook_metrics_exposure_http_basic_auth_users }}"

########################################################################
#                                                                      #
# /endlessh                                                            #
#                                                                      #
########################################################################
# /role-specific:endlessh

# role-specific:etcd
########################################################################
#                                                                      #
# etcd                                                                 #
#                                                                      #
########################################################################

etcd_enabled: false

etcd_identifier: "{{ mash_playbook_service_identifier_prefix }}etcd"

etcd_base_path: "{{ mash_playbook_base_path }}/{{ mash_playbook_service_base_directory_name_prefix }}etcd"

etcd_uid: "{{ mash_playbook_uid }}"
etcd_gid: "{{ mash_playbook_gid }}"

etcd_environment_variable_etcd_root_password: "{{ '' if etcd_environment_variable_allow_none_authentication else ('%s' | format(mash_playbook_generic_secret_key) | password_hash('sha512', 'etcd', rounds=655555) | to_uuid) }}"

########################################################################
#                                                                      #
# /etcd                                                                #
#                                                                      #
########################################################################
# /role-specific:etcd


# role-specific:exim_relay
########################################################################
#                                                                      #
# exim_relay                                                           #
#                                                                      #
########################################################################

exim_relay_enabled: false

exim_relay_identifier: "{{ mash_playbook_service_identifier_prefix }}exim-relay"

exim_relay_base_path: "{{ mash_playbook_base_path }}/{{ mash_playbook_service_base_directory_name_prefix }}exim-relay"

exim_relay_uid: "{{ mash_playbook_uid }}"
exim_relay_gid: "{{ mash_playbook_gid }}"

########################################################################
#                                                                      #
# /exim_relay                                                          #
#                                                                      #
########################################################################
# /role-specific:exim_relay


# role-specific:firezone
########################################################################
#                                                                      #
# firezone                                                             #
#                                                                      #
########################################################################

firezone_enabled: false

firezone_identifier: "{{ mash_playbook_service_identifier_prefix }}firezone"

firezone_base_path: "{{ mash_playbook_base_path }}/{{ mash_playbook_service_base_directory_name_prefix }}firezone"

firezone_uid: "{{ mash_playbook_uid }}"
firezone_gid: "{{ mash_playbook_gid }}"
firezone_generic_secret: "{{ mash_playbook_generic_secret_key }}"

# role-specific:postgres
firezone_database_host: "{{ devture_postgres_identifier if devture_postgres_enabled else '' }}"
firezone_database_port: "{{ '5432' if devture_postgres_enabled else '' }}"
firezone_database_password: "{{ '%s' | format(mash_playbook_generic_secret_key) | password_hash('sha512', 'fz.db.user', rounds=655555) | to_uuid }}"
firezone_database_username: "{{ firezone_identifier }}"
# /role-specific:postgres

firezone_systemd_required_services_list_auto: |
  {{
    ([devture_postgres_identifier ~ '.service'] if devture_postgres_enabled | default(false) and firezone_database_host == devture_postgres_identifier else [])
  }}

firezone_container_additional_networks_auto: |
  {{
    ([mash_playbook_reverse_proxyable_services_additional_network] if mash_playbook_reverse_proxyable_services_additional_network else [])
    +
    ([devture_postgres_container_network] if devture_postgres_enabled | default(false) and firezone_database_host == devture_postgres_identifier and firezone_container_network != devture_postgres_container_network else [])
  }}

firezone_container_labels_traefik_enabled: "{{ mash_playbook_traefik_labels_enabled }}"
firezone_container_labels_traefik_docker_network: "{{ mash_playbook_reverse_proxyable_services_additional_network }}"

# role-specific:traefik
firezone_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
firezone_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}"
# /role-specific:traefik

########################################################################
#                                                                      #
# /firezone                                                            #
#                                                                      #
########################################################################
# /role-specific:firezone



# role-specific:focalboard
########################################################################
#                                                                      #
# focalboard                                                           #
#                                                                      #
########################################################################

focalboard_enabled: false

focalboard_identifier: "{{ mash_playbook_service_identifier_prefix }}focalboard"

focalboard_base_path: "{{ mash_playbook_base_path }}/{{ mash_playbook_service_base_directory_name_prefix }}focalboard"

focalboard_uid: "{{ mash_playbook_uid }}"
focalboard_gid: "{{ mash_playbook_gid }}"

focalboard_systemd_required_systemd_services_list_auto: |
  {{
    ([devture_postgres_identifier ~ '.service'] if devture_postgres_enabled and focalboard_database_hostname == devture_postgres_identifier else [])
  }}

# role-specific:postgres
focalboard_database_type: "{{ 'postgres' if devture_postgres_enabled else '' }}"
focalboard_database_hostname: "{{ devture_postgres_identifier if devture_postgres_enabled else '' }}"
focalboard_database_port: "{{ '5432' if devture_postgres_enabled else '' }}"
focalboard_database_password: "{{ '%s' | format(mash_playbook_generic_secret_key) | password_hash('sha512', 'db.focalboard', rounds=655555) | to_uuid }}"
# /role-specific:postgres

focalboard_container_additional_networks_auto: |
  {{
    ([mash_playbook_reverse_proxyable_services_additional_network] if mash_playbook_reverse_proxyable_services_additional_network else [])
    +
    ([devture_postgres_container_network] if devture_postgres_enabled | default(false) and focalboard_database_hostname == devture_postgres_identifier else [])
  }}

focalboard_container_labels_traefik_enabled: "{{ mash_playbook_traefik_labels_enabled }}"
focalboard_container_labels_traefik_docker_network: "{{ mash_playbook_reverse_proxyable_services_additional_network }}"

# role-specific:traefik
focalboard_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
focalboard_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}"
# /role-specific:traefik

########################################################################
#                                                                      #
# /focalboard                                                          #
#                                                                      #
########################################################################
# /role-specific:focalboard



# role-specific:freshrss
########################################################################
#                                                                      #
# freshrss                                                             #
#                                                                      #
########################################################################

freshrss_enabled: false

freshrss_identifier: "{{ mash_playbook_service_identifier_prefix }}freshrss"

freshrss_base_path: "{{ mash_playbook_base_path }}/{{ mash_playbook_service_base_directory_name_prefix }}freshrss"

# freshrss_uid and freshrss_gid are intentionally not being set here.
# FreshRSS can only work with a specific user and group, as hardcoded in the role defaults.
freshrss_uid: "0"
freshrss_gid: "33"

freshrss_systemd_required_services_list: |
  {{
    ([devture_systemd_docker_base_docker_service_name] if devture_systemd_docker_base_docker_service_name else [])
    +
    ([devture_postgres_identifier ~ '.service'] if devture_postgres_enabled and freshrss_database_hostname == devture_postgres_identifier else [])
  }}

freshrss_container_additional_networks: |
  {{
    ([mash_playbook_reverse_proxyable_services_additional_network] if mash_playbook_reverse_proxyable_services_additional_network else [])
    +
    ([devture_postgres_container_network] if devture_postgres_enabled and freshrss_database_hostname == devture_postgres_identifier and freshrss_container_network != devture_postgres_container_network else [])
  }}

freshrss_container_labels_traefik_enabled: "{{ mash_playbook_traefik_labels_enabled }}"
freshrss_container_labels_traefik_docker_network: "{{ mash_playbook_reverse_proxyable_services_additional_network }}"
freshrss_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
freshrss_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}"

freshrss_database_hostname: "{{ devture_postgres_connection_hostname if devture_postgres_enabled else '' }}"

# Intentionally not auto-generating freshrss_database_password.
# It's meant to be explicitly defined, so that it can be used in the setup wizard after installation.

########################################################################
#                                                                      #
# /freshrss                                                            #
#                                                                      #
########################################################################
# /role-specific:freshrss


# role-specific:funkwhale
########################################################################
#                                                                      #
# funkwhale                                                            #
#                                                                      #
########################################################################

funkwhale_enabled: false

funkwhale_identifier: "{{ mash_playbook_service_identifier_prefix }}funkwhale"

funkwhale_base_path: "{{ mash_playbook_base_path }}/{{ mash_playbook_service_base_directory_name_prefix }}funkwhale"

funkwhale_uid: "{{ mash_playbook_uid }}"
funkwhale_gid: "{{ mash_playbook_gid }}"

funkwhale_database_hostname: "{{ devture_postgres_identifier if devture_postgres_enabled else '' }}"
funkwhale_database_port: "{{ '5432' if devture_postgres_enabled else '' }}"
funkwhale_database_password: "{{ '%s' | format(mash_playbook_generic_secret_key) | password_hash('sha512', 'db.funkwhale', rounds=655555) | to_uuid }}"
funkwhale_database_username: "{{ funkwhale_identifier }}"

funkwhale_api_systemd_required_services_list_auto: |
  {{
    ([devture_postgres_identifier ~ '.service'] if devture_postgres_enabled and funkwhale_database_hostname == devture_postgres_identifier else [])
  }}

funkwhale_frontend_systemd_required_services_list_auto: |
  {{
    ([devture_postgres_identifier ~ '.service'] if devture_postgres_enabled and funkwhale_database_hostname == devture_postgres_identifier else [])
  }}

funkwhale_api_container_additional_networks_auto: |
  {{
    ([mash_playbook_reverse_proxyable_services_additional_network] if mash_playbook_reverse_proxyable_services_additional_network else [])
    +
    ([devture_postgres_container_network] if devture_postgres_enabled and funkwhale_database_hostname == devture_postgres_identifier and funkwhale_api_container_network != devture_postgres_container_network else [])
  }}

funkwhale_frontend_container_additional_networks_auto: |
  {{
    ([devture_postgres_container_network] if devture_postgres_enabled and funkwhale_database_hostname == devture_postgres_identifier and funkwhale_frontend_container_network != devture_postgres_container_network else [])
    +
    ([mash_playbook_reverse_proxyable_services_additional_network] if mash_playbook_reverse_proxyable_services_additional_network else [])
  }}

funkwhale_api_container_labels_traefik_enabled: "{{ mash_playbook_traefik_labels_enabled }}"
funkwhale_api_container_labels_traefik_docker_network: "{{ mash_playbook_reverse_proxyable_services_additional_network }}"
funkwhale_api_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
funkwhale_api_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}"

funkwhale_frontend_container_labels_traefik_enabled: "{{ mash_playbook_traefik_labels_enabled }}"
funkwhale_frontend_container_labels_traefik_docker_network: "{{ mash_playbook_reverse_proxyable_services_additional_network }}"
funkwhale_frontend_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
funkwhale_frontend_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}"

########################################################################
#                                                                      #
# /funkwhale                                                           #
#                                                                      #
########################################################################
# /role-specific:funkwhale


# role-specific:gitea
########################################################################
#                                                                      #
# gitea                                                                #
#                                                                      #
########################################################################

gitea_enabled: false

gitea_identifier: "{{ mash_playbook_service_identifier_prefix }}gitea"

gitea_base_path: "{{ mash_playbook_base_path }}/{{ mash_playbook_service_base_directory_name_prefix }}gitea"

gitea_uid: "{{ mash_playbook_uid }}"
gitea_gid: "{{ mash_playbook_gid }}"

gitea_systemd_required_systemd_services_list_auto: |
  {{
    ([devture_postgres_identifier ~ '.service'] if devture_postgres_enabled and gitea_config_database_hostname == devture_postgres_identifier else [])
  }}

gitea_container_additional_networks_auto: |
  {{
    ([mash_playbook_reverse_proxyable_services_additional_network] if mash_playbook_reverse_proxyable_services_additional_network else [])
    +
    ([devture_postgres_container_network] if devture_postgres_enabled and gitea_config_database_hostname == devture_postgres_identifier and gitea_container_network != devture_postgres_container_network else [])
    +
    ([exim_relay_container_network | default('mash-exim-relay')] if (exim_relay_enabled | default(false) and gitea_config_mailer_smtp_addr == exim_relay_identifier | default('mash-exim-relay') and gitea_container_network != exim_relay_container_network) else [])
  }}

gitea_container_labels_traefik_enabled: "{{ mash_playbook_traefik_labels_enabled }}"
gitea_container_labels_traefik_docker_network: "{{ mash_playbook_reverse_proxyable_services_additional_network }}"
gitea_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
gitea_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}"

gitea_config_database_hostname: "{{ devture_postgres_identifier if devture_postgres_enabled else '' }}"
gitea_config_database_port: "{{ '5432' if devture_postgres_enabled else '' }}"
gitea_config_database_username: "gitea"
gitea_config_database_password: "{{ '%s' | format(mash_playbook_generic_secret_key) | password_hash('sha512', 'db.gitea', rounds=655555) | to_uuid }}"

# role-specific:exim_relay
gitea_config_mailer_enabled: "{{ 'true' if exim_relay_enabled else '' }}"
gitea_config_mailer_smtp_addr: "{{ exim_relay_identifier if exim_relay_enabled else '' }}"
gitea_config_mailer_smtp_port: 8025
gitea_config_mailer_from: "{{ exim_relay_sender_address if exim_relay_enabled else '' }}"
gitea_config_mailer_protocol: "{{ 'smtp' if exim_relay_enabled else '' }}"
# /role-specific:exim_relay

########################################################################
#                                                                      #
# /gitea                                                               #
#                                                                      #
########################################################################
# /role-specific:gitea



# role-specific:gotosocial
########################################################################
#                                                                      #
# gotosocial                                                           #
#                                                                      #
########################################################################

gotosocial_enabled: false

gotosocial_identifier: "{{ mash_playbook_service_identifier_prefix }}gotosocial"

gotosocial_base_path: "{{ mash_playbook_base_path }}/{{ mash_playbook_service_base_directory_name_prefix }}gotosocial"

gotosocial_uid: "{{ mash_playbook_uid }}"
gotosocial_gid: "{{ mash_playbook_gid }}"

gotosocial_systemd_required_services_list_auto: |
  {{
    ([devture_postgres_identifier ~ '.service'] if devture_postgres_enabled and gotosocial_database_host == devture_postgres_identifier else [])
  }}

gotosocial_systemd_wanted_services_list_auto: |
  {{
    ([(exim_relay_identifier | default('mash-exim-relay')) ~ '.service'] if (exim_relay_enabled | default(false) and gotosocial_smtp_host == exim_relay_identifier | default('mash-exim-relay')) else [])
  }}

gotosocial_container_additional_networks_auto: |
  {{
    ([mash_playbook_reverse_proxyable_services_additional_network] if mash_playbook_reverse_proxyable_services_additional_network else [])
    +
    ([devture_postgres_container_network] if devture_postgres_enabled and gotosocial_database_host == devture_postgres_identifier and gotosocial_container_network != devture_postgres_container_network else [])
    +
    ([exim_relay_container_network | default('mash-exim-relay')] if (exim_relay_enabled | default(false) and gotosocial_smtp_host == exim_relay_identifier | default('mash-exim-relay') and gotosocial_container_network != exim_relay_container_network) else [])
  }}

gotosocial_container_labels_traefik_enabled: "{{ mash_playbook_traefik_labels_enabled }}"
gotosocial_container_labels_traefik_docker_network: "{{ mash_playbook_reverse_proxyable_services_additional_network }}"
gotosocial_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
gotosocial_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}"

gotosocial_database_host: "{{ devture_postgres_identifier if devture_postgres_enabled else '' }}"
gotosocial_database_port: "{{ '5432' if devture_postgres_enabled else '' }}"
gotosocial_database_password: "{{ '%s' | format(mash_playbook_generic_secret_key) | password_hash('sha512', 'db.gotosocial', rounds=655555) | to_uuid }}"
gotosocial_database_username: "{{ gotosocial_identifier }}"

# role-specific:exim_relay
gotosocial_smtp_host: "{{ exim_relay_identifier if exim_relay_enabled else '' }}"
gotosocial_smtp_port: 8025
gotosocial_smtp_from: "{{ exim_relay_sender_address if exim_relay_enabled else '' }}"
# /role-specific:exim_relay

########################################################################
#                                                                      #
# /gotosocial                                                          #
#                                                                      #
########################################################################
# /role-specific:gotosocial



# role-specific:grafana
########################################################################
#                                                                      #
# grafana                                                              #
#                                                                      #
########################################################################

grafana_enabled: false

grafana_identifier: "{{ mash_playbook_service_identifier_prefix }}grafana"

grafana_base_path: "{{ mash_playbook_base_path }}/{{ mash_playbook_service_base_directory_name_prefix }}grafana"

grafana_uid: "{{ mash_playbook_uid }}"
grafana_gid: "{{ mash_playbook_gid }}"


# role-specific:exim_relay
grafana_smtp_enabled: "{{ exim_relay_enabled | default(false) }}"
grafana_smtp_host: "{{ exim_relay_identifier if exim_relay_enabled else '' }}"
grafana_smtp_port: 8025
grafana_smtp_from_address: "{{ exim_relay_sender_address if exim_relay_enabled else '' }}"
# /role-specific:exim_relay

grafana_container_additional_networks_auto: |
  {{
    ([mash_playbook_reverse_proxyable_services_additional_network] if (grafana_container_labels_traefik_enabled and mash_playbook_reverse_proxyable_services_additional_network) else [])
    +
    ([exim_relay_container_network | default('mash-exim-relay')] if (exim_relay_enabled | default(false) and grafana_smtp_host == exim_relay_identifier | default('mash-exim-relay') and grafana_container_network != exim_relay_container_network) else [])
  }}

grafana_container_labels_traefik_enabled: "{{ mash_playbook_traefik_labels_enabled }}"
grafana_container_labels_traefik_docker_network: "{{ mash_playbook_reverse_proxyable_services_additional_network }}"
grafana_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
grafana_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}"

########################################################################
#                                                                      #
# /grafana                                                             #
#                                                                      #
########################################################################
# /role-specific:grafana



# role-specific:healthchecks
########################################################################
#                                                                      #
# healthchecks                                                         #
#                                                                      #
########################################################################

healthchecks_enabled: false

healthchecks_identifier: "{{ mash_playbook_service_identifier_prefix }}healthchecks"

healthchecks_base_path: "{{ mash_playbook_base_path }}/{{ mash_playbook_service_base_directory_name_prefix }}healthchecks"

healthchecks_uid: "{{ mash_playbook_uid }}"
healthchecks_gid: "{{ mash_playbook_gid }}"

healthchecks_systemd_required_systemd_services_list_auto: |
  {{
    ([devture_postgres_identifier ~ '.service'] if devture_postgres_enabled and healthchecks_database_hostname == devture_postgres_identifier else [])
  }}

healthchecks_systemd_wanted_systemd_services_list_auto: |
  {{
    ([(exim_relay_identifier | default('mash-exim-relay')) ~ '.service'] if (exim_relay_enabled | default(false) and healthchecks_environment_variable_email_host == exim_relay_identifier | default('mash-exim-relay')) else [])
  }}

healthchecks_container_additional_networks_auto: |
  {{
    ([mash_playbook_reverse_proxyable_services_additional_network] if mash_playbook_reverse_proxyable_services_additional_network else [])
    +
    ([devture_postgres_container_network] if devture_postgres_enabled and healthchecks_database_hostname == devture_postgres_identifier and healthchecks_container_network != devture_postgres_container_network else [])
    +
    ([exim_relay_container_network | default('mash-exim-relay')] if (exim_relay_enabled | default(false) and healthchecks_environment_variable_email_host == exim_relay_identifier | default('mash-exim-relay') and healthchecks_container_network != exim_relay_container_network) else [])
  }}

healthchecks_container_labels_traefik_enabled: "{{ mash_playbook_traefik_labels_enabled }}"
healthchecks_container_labels_traefik_docker_network: "{{ mash_playbook_reverse_proxyable_services_additional_network }}"
healthchecks_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
healthchecks_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}"

healthchecks_database_hostname: "{{ devture_postgres_connection_hostname if devture_postgres_enabled else '' }}"
healthchecks_database_password: "{{ '%s' | format(mash_playbook_generic_secret_key) | password_hash('sha512', 'healthchecks.db', rounds=655555) | to_uuid }}"

healthchecks_environment_variable_secret_key: "{{ '%s' | format(mash_playbook_generic_secret_key) | password_hash('sha512', 'healthchecks', rounds=655555) | to_uuid }}"

# role-specific:exim_relay
healthchecks_environment_variable_default_from_email: "{{ exim_relay_sender_address if exim_relay_enabled else '' }}"
healthchecks_environment_variable_email_host: "{{ exim_relay_identifier if exim_relay_enabled else '' }}"
healthchecks_environment_variable_email_port: "{{ 8025 if exim_relay_enabled else '587' }}"
healthchecks_environment_variable_email_use_tls: "{{ false if exim_relay_enabled else true }}"
healthchecks_environment_variable_email_use_verification: "{{ false if exim_relay_enabled else true }}"
# /role-specific:exim_relay

########################################################################
#                                                                      #
# /healthchecks                                                        #
#                                                                      #
########################################################################
# /role-specific:healthchecks



# role-specific:hubsite
########################################################################
#                                                                      #
# hubsite                                                              #
#                                                                      #
########################################################################

hubsite_enabled: false

hubsite_identifier: "{{ mash_playbook_service_identifier_prefix }}hubsite"

hubsite_base_path: "{{ mash_playbook_base_path }}/{{ mash_playbook_service_base_directory_name_prefix }}hubsite"

hubsite_uid: "{{ mash_playbook_uid }}"
hubsite_gid: "{{ mash_playbook_gid }}"

hubsite_systemd_required_services_list: |
  {{
    ([devture_systemd_docker_base_docker_service_name] if devture_systemd_docker_base_docker_service_name else [])
  }}

hubsite_container_additional_networks: |
  {{
    ([mash_playbook_reverse_proxyable_services_additional_network] if mash_playbook_reverse_proxyable_services_additional_network else [])
  }}

hubsite_container_labels_traefik_enabled: "{{ mash_playbook_traefik_labels_enabled }}"
hubsite_container_labels_traefik_docker_network: "{{ mash_playbook_reverse_proxyable_services_additional_network }}"
hubsite_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
hubsite_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}"

# Services
##########

# role-specific:adguard_home
# Adguard home
hubsite_service_adguard_home_enabled: "{{ adguard_home_enabled }}"
hubsite_service_adguard_home_name: Adguard Home
hubsite_service_adguard_home_url: "https://{{ adguard_home_hostname }}{{ adguard_home_path_prefix }}"
hubsite_service_adguard_home_logo_location: "{{ role_path }}/assets/shield.png"
hubsite_service_adguard_home_description: "A network-wide DNS software for blocking ads & tracking"
hubsite_service_adguard_home_priority: 1000
# /role-specific:adguard_home

# role-specific:authentik
# authentik
hubsite_service_authentik_enabled: "{{ authentik_enabled }}"
hubsite_service_authentik_name: Authentik
hubsite_service_authentik_url: "https://{{ authentik_hostname }}"
hubsite_service_authentik_logo_location: "{{ role_path }}/assets/authentik.png"
hubsite_service_authentik_description: "An open source identity provider"
hubsite_service_authentik_priority: 1000
# /role-specific:authentik

# role-specific:appsmith
# Appsmith
hubsite_service_appsmith_enabled: "{{ appsmith_enabled }}"
hubsite_service_appsmith_name: Appsmith
hubsite_service_appsmith_url: "https://{{ appsmith_hostname }}{{ appsmith_path_prefix }}"
hubsite_service_appsmith_logo_location: "{{ role_path }}/assets/appsmith.png"
hubsite_service_appsmith_description: "Platform for building and deploying custom internal tools and applications without writing code"
hubsite_service_appsmith_priority: 1000
# /role-specific:appsmith

# role-specific:docker_registry_browser
# Docker Registry Browser
hubsite_service_docker_registry_browser_enabled: "{{ docker_registry_browser_enabled }}"
hubsite_service_docker_registry_browser_name: Docker Registry Browser
hubsite_service_docker_registry_browser_url: "https://{{ docker_registry_browser_hostname }}{{ docker_registry_browser_path_prefix }}"
hubsite_service_docker_registry_browser_logo_location: "{{ role_path }}/assets/docker.png"
hubsite_service_docker_registry_browser_description: "Browse docker images"
hubsite_service_docker_registry_browser_priority: 1000
# /role-specific:docker_registry_browser

# role-specific:firezone
# Firezone
hubsite_service_firezone_enabled: "{{ firezone_enabled }}"
hubsite_service_firezone_name: Firezone
hubsite_service_firezone_url: "https://{{ firezone_hostname }}"
hubsite_service_firezone_logo_location: "{{ role_path }}/assets/firezone.png"
hubsite_service_firezone_description: "A self-hosted VPN server, based on Wireguard"
hubsite_service_firezone_priority: 1000
# /role-specific:firezone

# role-specific:focalboard
# Focalboard
hubsite_service_focalboard_enabled: "{{ focalboard_enabled }}"
hubsite_service_focalboard_name: Focalboard
hubsite_service_focalboard_url: "https://{{ focalboard_hostname }}{{ focalboard_path_prefix }}"
hubsite_service_focalboard_logo_location: "{{ role_path }}/assets/focalboard.png"
hubsite_service_focalboard_description: "An open source, self-hosted alternative to Trello, Notion, and Asana."
hubsite_service_focalboard_priority: 1000
# /role-specific:focalboard

# role-specific:freshrss
# FreshRSS
hubsite_service_freshrss_enabled: "{{ freshrss_enabled }}"
hubsite_service_freshrss_name: FreshRSS
hubsite_service_freshrss_url: "https://{{ freshrss_hostname }}{{ freshrss_path_prefix }}"
hubsite_service_freshrss_logo_location: "{{ role_path }}/assets/freshrss.png"
hubsite_service_freshrss_description: "RSS and Atom feed aggregator."
hubsite_service_freshrss_priority: 1000
# /role-specific:freshrss

# role-specific:funkwhale
# Funkwhale
hubsite_service_funkwhale_enabled: "{{ funkwhale_enabled }}"
hubsite_service_funkwhale_name: Funkwhale
hubsite_service_funkwhale_url: "https://{{ funkwhale_hostname }}"
hubsite_service_funkwhale_logo_location: "{{ role_path }}/assets/funkwhale.png"
hubsite_service_funkwhale_description: "Listen and share music with a selfhosted streaming server"
hubsite_service_funkwhale_priority: 1000
# /role-specific:funkwhale

# role-specific:gitea
# Gitea
hubsite_service_gitea_enabled: "{{ gitea_enabled }}"
hubsite_service_gitea_name: Gitea
hubsite_service_gitea_url: "https://{{ gitea_hostname }}{{ gitea_path_prefix }}"
hubsite_service_gitea_logo_location: "{{ role_path }}/assets/gitea.png"
hubsite_service_gitea_description: "A git service"
hubsite_service_gitea_priority: 1000
# /role-specific:gitea

# role-specific:gotosocial
# GoToSocial
hubsite_service_gotosocial_enabled: "{{ gotosocial_enabled }}"
hubsite_service_gotosocial_name: GoToSocial
hubsite_service_gotosocial_url: "https://{{ gotosocial_hostname }}"
hubsite_service_gotosocial_logo_location: "{{ role_path }}/assets/gotosocial.png"
hubsite_service_gotosocial_description: "A fediverse server"
hubsite_service_gotosocial_priority: 1000
# /role-specific:gotosocial

# role-specific:grafana
# Grafana
hubsite_service_grafana_enabled: "{{ grafana_enabled }}"
hubsite_service_grafana_name: Grafana
hubsite_service_grafana_url: "https://{{ grafana_hostname }}{{ grafana_path_prefix }}"
hubsite_service_grafana_logo_location: "{{ role_path }}/assets/grafana.png"
hubsite_service_grafana_description: "Check how your server is doing"
hubsite_service_grafana_priority: 1000
# /role-specific:grafana

# role-specific:healthchecks
# Healthchecks
hubsite_service_healthchecks_enabled: "{{ healthchecks_enabled }}"
hubsite_service_healthchecks_name: Healthchecks
hubsite_service_healthchecks_url: "https://{{ healthchecks_hostname }}{{ healthchecks_path_prefix }}"
hubsite_service_healthchecks_logo_location: "{{ role_path }}/assets/healthchecks.png"
hubsite_service_healthchecks_description: "A simple and Effective Cron Job Monitoring solution"
hubsite_service_healthchecks_priority: 1000
# /role-specific:healthchecks

# role-specific:keycloak
# Keycloak
hubsite_service_keycloak_enabled: "{{ keycloak_enabled }}"
hubsite_service_keycloak_name: Keycloak
hubsite_service_keycloak_url: "https://{{ keycloak_hostname }}{{ keycloak_path_prefix }}"
hubsite_service_keycloak_logo_location: "{{ role_path }}/assets/keycloak.png"
hubsite_service_keycloak_description: "An open source identity and access management solution."
hubsite_service_keycloak_priority: 1000
# /role-specific:keycloak

# role-specific:languagetool
# LanguageTool
hubsite_service_languagetool_enabled: "{{ languagetool_enabled }}"
hubsite_service_languagetool_name: LanguageTool
hubsite_service_languagetool_url: "https://{{ languagetool_hostname }}{{ languagetool_path_prefix }}"
hubsite_service_languagetool_logo_location: "{{ role_path }}/assets/languagetool.png"
hubsite_service_languagetool_description: "An open source online grammar, style and spell checker"
hubsite_service_languagetool_priority: 1000
# /role-specific:languagetool

# role-specific:miniflux
# Miniflux
hubsite_service_miniflux_enabled: "{{ miniflux_enabled }}"
hubsite_service_miniflux_name: Miniflux
hubsite_service_miniflux_url: "https://{{ miniflux_hostname }}{{ miniflux_path_prefix }}"
hubsite_service_miniflux_logo_location: "{{ role_path }}/assets/miniflux.png"
hubsite_service_miniflux_description: "An opinionated feed reader"
hubsite_service_miniflux_priority: 1000
# /role-specific:miniflux

# role-specific:n8n
# n8n
hubsite_service_n8n_enabled: "{{ n8n_enabled }}"
hubsite_service_n8n_name: n8n
hubsite_service_n8n_url: "https://{{ n8n_hostname }}{{ n8n_path_prefix }}"
hubsite_service_n8n_logo_location: "{{ role_path }}/assets/n8n.png"
hubsite_service_n8n_description: "Workflow automation for technical people."
hubsite_service_n8n_priority: 1000
# /role-specific:n8n

# role-specific:linkding
# Linkding
hubsite_service_linkding_enabled: "{{ linkding_enabled }}"
hubsite_service_linkding_name: Linkding
hubsite_service_linkding_url: "https://{{ linkding_hostname }}{{ linkding_path_prefix }}"
hubsite_service_linkding_logo_location: "{{ role_path }}/assets/linkding.png"
hubsite_service_linkding_description: "Bookmark manager that is designed be to be minimal and fast."
hubsite_service_linkding_priority: 1000
# /role-specific:linkding

# role-specific:nextcloud
# Nextcloud
hubsite_service_nextcloud_enabled: "{{ nextcloud_enabled }}"
hubsite_service_nextcloud_name: Nextcloud
hubsite_service_nextcloud_url: "https://{{ nextcloud_hostname }}{{ nextcloud_path_prefix }}"
hubsite_service_nextcloud_logo_location: "{{ role_path }}/assets/nextcloud.png"
hubsite_service_nextcloud_description: "Sync your files & much more"
hubsite_service_nextcloud_priority: 1000
# /role-specific:nextcloud

# role-specific:owncast
# Owncast
hubsite_service_owncast_enabled: "{{ owncast_enabled }}"
hubsite_service_owncast_name: Owncast
hubsite_service_owncast_url: "https://{{ owncast_hostname }}"
hubsite_service_owncast_logo_location: "{{ role_path }}/assets/owncast.png"
hubsite_service_owncast_description: "Livestream & Chat"
hubsite_service_owncast_priority: 1000
# /role-specific:owncast

# role-specific:peertube
# Peertube
hubsite_service_peertube_enabled: "{{ peertube_enabled }}"
hubsite_service_peertube_name: Peertube
hubsite_service_peertube_url: "https://{{ peertube_hostname }}{{ peertube_path_prefix }}"
hubsite_service_peertube_logo_location: "{{ role_path }}/assets/peertube.png"
hubsite_service_peertube_description: "Watch and upload videos"
hubsite_service_peertube_priority: 1000
# /role-specific:peertube

# role-specific:radicale
# Radicale
hubsite_service_radicale_enabled: "{{ radicale_enabled }}"
hubsite_service_radicale_name: Radicale
hubsite_service_radicale_url: "https://{{ radicale_hostname }}{{ radicale_path_prefix }}"
hubsite_service_radicale_logo_location: "{{ role_path }}/assets/radicale.png"
hubsite_service_radicale_description: "Sync contacts and calendars"
hubsite_service_radicale_priority: 1000
# /role-specific:radicale

# role-specific:syncthing
# Syncthing
hubsite_service_syncthing_enabled: "{{ syncthing_enabled }}"
hubsite_service_syncthing_name: Syncthing
hubsite_service_syncthing_url: "https://{{ syncthing_hostname }}{{ syncthing_path_prefix }}"
hubsite_service_syncthing_logo_location: "{{ role_path }}/assets/syncthing.png"
hubsite_service_syncthing_description: "Sync your files"
hubsite_service_syncthing_priority: 1000
# /role-specific:syncthing

# role-specific:tandoor
# tandoor
hubsite_service_tandoor_enabled: "{{ tandoor_enabled }}"
hubsite_service_tandoor_name: tandoor
hubsite_service_tandoor_url: "https://{{ tandoor_hostname }}{{ tandoor_path_prefix }}"
hubsite_service_tandoor_logo_location: "{{ role_path }}/assets/tandoor.png"
hubsite_service_tandoor_description: "The recipe manager that allows you to manage your ever growing collection of digital recipes."
hubsite_service_tandoor_priority: 1000
# /role-specific:tandoor

# role-specific:uptime_kuma
# Uptime Kuma
hubsite_service_uptime_kuma_enabled: "{{ uptime_kuma_enabled }}"
hubsite_service_uptime_kuma_name: Uptime Kuma
hubsite_service_uptime_kuma_url: "https://{{ uptime_kuma_hostname }}{{ uptime_kuma_path_prefix }}"
hubsite_service_uptime_kuma_logo_location: "{{ role_path }}/assets/uptime-kuma.png"
hubsite_service_uptime_kuma_description: "Check the status of the services"
hubsite_service_uptime_kuma_priority: 1000
# /role-specific:uptime_kuma

# role-specific:vaultwarden
# Vaultwarden
# The vaultwarden service link is deactivated by default for security reasons, see: https://github.com/dani-garcia/vaultwarden/wiki/Hardening-Guide#hiding-under-a-subdir
hubsite_service_vaultwarden_enabled: false
hubsite_service_vaultwarden_name: Vaultwarden
hubsite_service_vaultwarden_url: "https://{{ vaultwarden_hostname }}{{ vaultwarden_path_prefix }}"
hubsite_service_vaultwarden_logo_location: "{{ role_path }}/assets/vaultwarden.png"
hubsite_service_vaultwarden_description: "Securely access your passwords"
hubsite_service_vaultwarden_priority: 1000
# /role-specific:vaultwarden

# role-specific:woodpecker_ci_server
# Woodpecker CI
hubsite_service_woodpecker_ci_enabled: "{{ devture_woodpecker_ci_server_enabled }}"
hubsite_service_woodpecker_ci_name: Woodpecker CI
hubsite_service_woodpecker_ci_url: "https://{{ devture_woodpecker_ci_server_hostname }}"
hubsite_service_woodpecker_ci_logo_location: "{{ role_path }}/assets/woodpecker.png"
hubsite_service_woodpecker_ci_description: "Check you CI"
hubsite_service_woodpecker_ci_priority: 1000
# /role-specific:woodpecker_ci_server

# role-specific:writefreely
# writefreely
hubsite_service_writefreely_enabled: "{{ writefreely_enabled }}"
hubsite_service_writefreely_name: writefreely
hubsite_service_writefreely_url: "https://{{ writefreely_hostname }}"
hubsite_service_writefreely_logo_location: "{{ role_path }}/assets/writefreely.png"
hubsite_service_writefreely_description: "A minimalist web blog"
hubsite_service_writefreely_priority: 1000
# /role-specific:writefreely

# role-specific:forgejo
# Forgejo
hubsite_service_forgejo_enabled: "{{ forgejo_enabled }}"
hubsite_service_forgejo_name: Forgejo
hubsite_service_forgejo_url: "https://{{ forgejo_hostname }}{{ forgejo_path_prefix }}"
hubsite_service_forgejo_logo_location: "{{ role_path }}/assets/forgejo.png"
hubsite_service_forgejo_description: "Another git service"
hubsite_service_forgejo_priority: 1000
# /role-specific:forgejo

mash_playbook_hubsite_service_list_auto_itemized:
  # Dummy entry, which is not role-specific.
  # Ensures there's at least one entry defined in the list.
  - "{{ omit }}"

  # role-specific:adguard_home
  - |-
    {{
      ({
        'name': hubsite_service_adguard_home_name,
        'url': hubsite_service_adguard_home_url,
        'logo_location': hubsite_service_adguard_home_logo_location,
        'description': hubsite_service_adguard_home_description,
        'priority': hubsite_service_adguard_home_priority,
      } if hubsite_service_adguard_home_enabled else omit)
    }}
  # /role-specific:adguard_home

  # role-specific:authentik
  - |-
    {{
      ({
        'name': hubsite_service_authentik_name,
        'url': hubsite_service_authentik_url,
        'logo_location': hubsite_service_authentik_logo_location,
        'description': hubsite_service_authentik_description,
        'priority': hubsite_service_adguard_home_priority,
      } if hubsite_service_authentik_enabled else omit)
    }}
  # /role-specific:authentik

  # role-specific:appsmith
  - |-
    {{
      ({
        'name': hubsite_service_appsmith_name,
        'url': hubsite_service_appsmith_url,
        'logo_location': hubsite_service_appsmith_logo_location,
        'description': hubsite_service_appsmith_description,
        'priority': hubsite_service_appsmith_priority,
      } if hubsite_service_appsmith_enabled else omit)
    }}
  # /role-specific:appsmith

  # role-specific:docker_registry_browser
  - |-
    {{
      ({
        'name': hubsite_service_docker_registry_browser_name,
        'url': hubsite_service_docker_registry_browser_url,
        'logo_location': hubsite_service_docker_registry_browser_logo_location,
        'description': hubsite_service_docker_registry_browser_description,
        'priority': hubsite_service_docker_registry_browser_priority,
      } if hubsite_service_docker_registry_browser_enabled else omit)
    }}
  # /role-specific:docker_registry_browser

  # role-specific:firezone
  - |-
    {{
      ({
        'name': hubsite_service_firezone_name,
        'url': hubsite_service_firezone_url,
        'logo_location': hubsite_service_firezone_logo_location,
        'description': hubsite_service_firezone_description,
        'priority': hubsite_service_firezone_priority,
      } if hubsite_service_firezone_enabled else omit)
    }}
  # /role-specific:firezone

  # role-specific:focalboard
  - |-
    {{
      ({
        'name': hubsite_service_focalboard_name,
        'url': hubsite_service_focalboard_url,
        'logo_location': hubsite_service_focalboard_logo_location,
        'description': hubsite_service_focalboard_description,
        'priority': hubsite_service_focalboard_priority,
      } if hubsite_service_focalboard_enabled else omit)
    }}
  # /role-specific:focalboard

  # role-specific:freshrss
  - |-
    {{
      ({
        'name': hubsite_service_freshrss_name,
        'url': hubsite_service_freshrss_url,
        'logo_location': hubsite_service_freshrss_logo_location,
        'description': hubsite_service_freshrss_description,
        'priority': hubsite_service_freshrss_priority,
      } if hubsite_service_freshrss_enabled else omit)
    }}
  # /role-specific:freshrss

  # role-specific:funkwhale
  - |-
    {{
      ({
        'name': hubsite_service_funkwhale_name,
        'url': hubsite_service_funkwhale_url,
        'logo_location': hubsite_service_funkwhale_logo_location,
        'description': hubsite_service_funkwhale_description,
        'priority': hubsite_service_funkwhale_priority,
      } if hubsite_service_funkwhale_enabled else omit)
    }}
  # /role-specific:funkwhale

  # role-specific:gitea
  - |-
    {{
      ({
        'name': hubsite_service_gitea_name,
        'url': hubsite_service_gitea_url,
        'logo_location': hubsite_service_gitea_logo_location,
        'description': hubsite_service_gitea_description,
        'priority': hubsite_service_gitea_priority,
      } if hubsite_service_gitea_enabled else omit)
    }}
  # /role-specific:gitea

  # role-specific:gotosocial
  - |-
    {{
      ({
        'name': hubsite_service_gotosocial_name,
        'url': hubsite_service_gotosocial_url,
        'logo_location': hubsite_service_gotosocial_logo_location,
        'description': hubsite_service_gotosocial_description,
        'priority': hubsite_service_gotosocial_priority,
      } if hubsite_service_gotosocial_enabled else omit)
    }}
  # /role-specific:gotosocial

  # role-specific:grafana
  - |-
    {{
      ({
        'name': hubsite_service_grafana_name,
        'url': hubsite_service_grafana_url,
        'logo_location': hubsite_service_grafana_logo_location,
        'description': hubsite_service_grafana_description,
        'priority': hubsite_service_grafana_priority,
      } if hubsite_service_grafana_enabled else omit)
    }}
  # /role-specific:grafana

  # role-specific:healthchecks
  - |-
    {{
      ({
        'name': hubsite_service_healthchecks_name,
        'url': hubsite_service_healthchecks_url,
        'logo_location': hubsite_service_healthchecks_logo_location,
        'description': hubsite_service_healthchecks_description,
        'priority': hubsite_service_healthchecks_priority,
      } if hubsite_service_healthchecks_enabled else omit)
    }}
  # /role-specific:healthchecks

  # role-specific:keycloak
  - |-
    {{
      ({
        'name': hubsite_service_keycloak_name,
        'url': hubsite_service_keycloak_url,
        'logo_location': hubsite_service_keycloak_logo_location,
        'description': hubsite_service_keycloak_description,
        'priority': hubsite_service_keycloak_priority,
      } if hubsite_service_keycloak_enabled else omit)
    }}
  # /role-specific:keycloak

 # role-specific:languagetool
  - |-
    {{
      ({
        'name': hubsite_service_languagetool_name,
        'url': hubsite_service_languagetool_url,
        'logo_location': hubsite_service_languagetool_logo_location,
        'description': hubsite_service_languagetool_description,
        'priority': hubsite_service_languagetool_priority,
      } if hubsite_service_languagetool_enabled else omit)
    }}
  # /role-specific:languagetool

  # role-specific:miniflux
  - |-
    {{
      ({
        'name': hubsite_service_miniflux_name,
        'url': hubsite_service_miniflux_url,
        'logo_location': hubsite_service_miniflux_logo_location,
        'description': hubsite_service_miniflux_description,
        'priority': hubsite_service_miniflux_priority,
      } if hubsite_service_miniflux_enabled else omit)
    }}
  # /role-specific:miniflux

  # role-specific:n8n
  - |-
    {{
      ({
        'name': hubsite_service_n8n_name,
        'url': hubsite_service_n8n_url,
        'logo_location': hubsite_service_n8n_logo_location,
        'description': hubsite_service_n8n_description,
        'priority': hubsite_service_n8n_priority,
      } if hubsite_service_n8n_enabled else omit)
    }}
  # /role-specific:n8n

  # role-specific:nextcloud
  - |-
    {{
      ({
        'name': hubsite_service_nextcloud_name,
        'url': hubsite_service_nextcloud_url,
        'logo_location': hubsite_service_nextcloud_logo_location,
        'description': hubsite_service_nextcloud_description,
        'priority': hubsite_service_nextcloud_priority,
      } if hubsite_service_nextcloud_enabled else omit)
    }}
  # /role-specific:nextcloud

  # role-specific:linkding
  - |-
    {{
      ({
        'name': hubsite_service_linkding_name,
        'url': hubsite_service_linkding_url,
        'logo_location': hubsite_service_linkding_logo_location,
        'description': hubsite_service_linkding_description,
        'priority': hubsite_service_linkding_priority,
      } if hubsite_service_linkding_enabled else omit)
    }}
  # /role-specific:linkding

  # role-specific:owncast
  - |-
    {{
      ({
        'name': hubsite_service_owncast_name,
        'url': hubsite_service_owncast_url,
        'logo_location': hubsite_service_owncast_logo_location,
        'description': hubsite_service_owncast_description,
        'priority': hubsite_service_owncast_priority,
      } if hubsite_service_owncast_enabled else omit)
    }}
  # /role-specific:owncast

  # role-specific:peertube
  - |-
    {{
      ({
        'name': hubsite_service_peertube_name,
        'url': hubsite_service_peertube_url,
        'logo_location': hubsite_service_peertube_logo_location,
        'description': hubsite_service_peertube_description,
        'priority': hubsite_service_peertube_priority,
      } if hubsite_service_peertube_enabled else omit)
    }}
  # /role-specific:peertube

  # role-specific:radicale
  - |-
    {{
      ({
        'name': hubsite_service_radicale_name,
        'url': hubsite_service_radicale_url,
        'logo_location': hubsite_service_radicale_logo_location,
        'description': hubsite_service_radicale_description,
        'priority': hubsite_service_radicale_priority,
      } if hubsite_service_radicale_enabled else omit)
    }}
  # /role-specific:radicale

  # role-specific:uptime_kuma
  - |-
    {{
      ({
        'name': hubsite_service_uptime_kuma_name,
        'url': hubsite_service_uptime_kuma_url,
        'logo_location': hubsite_service_uptime_kuma_logo_location,
        'description': hubsite_service_uptime_kuma_description,
        'priority': hubsite_service_uptime_kuma_priority,
      } if hubsite_service_uptime_kuma_enabled else omit)
    }}
  # /role-specific:uptime_kuma

  # role-specific:syncthing
  - |-
    {{
      ({
        'name': hubsite_service_syncthing_name,
        'url': hubsite_service_syncthing_url,
        'logo_location': hubsite_service_syncthing_logo_location,
        'description': hubsite_service_syncthing_description,
        'priority': hubsite_service_syncthing_priority
      } if hubsite_service_syncthing_enabled else omit)
    }}
  # /role-specific:syncthing

  # role-specific:tandoor
  - |-
    {{
      ({
        'name': hubsite_service_tandoor_name,
        'url': hubsite_service_tandoor_url,
        'logo_location': hubsite_service_tandoor_logo_location,
        'description': hubsite_service_tandoor_description,
        'priority': hubsite_service_tandoor_priority,
      } if hubsite_service_tandoor_enabled else omit)
    }}
  # /role-specific:tandoor

  # role-specific:vaultwarden
  - |-
    {{
      ({
        'name': hubsite_service_vaultwarden_name,
        'url': hubsite_service_vaultwarden_url,
        'logo_location': hubsite_service_vaultwarden_logo_location,
        'description': hubsite_service_vaultwarden_description,
        'priority': hubsite_service_vaultwarden_priority
      } if hubsite_service_vaultwarden_enabled else omit)
    }}
  # /role-specific:vaultwarden

  # role-specific:woodpecker_ci_server
  - |-
    {{
      ({
        'name': hubsite_service_woodpecker_ci_name,
        'url': hubsite_service_woodpecker_ci_url,
        'logo_location': hubsite_service_woodpecker_ci_logo_location,
        'description': hubsite_service_woodpecker_ci_description,
        'priority': hubsite_service_woodpecker_ci_priority
      } if hubsite_service_woodpecker_ci_enabled else omit)
    }}
  # /role-specific:woodpecker_ci_server

  # role-specific:writefreely
  - |-
    {{
      ({
        'name': hubsite_service_writefreely_name,
        'url': hubsite_service_writefreely_url,
        'logo_location': hubsite_service_writefreely_logo_location,
        'description': hubsite_service_writefreely_description,
        'priority': hubsite_service_writefreely_priority,
      } if hubsite_service_writefreely_enabled else omit)
    }}
  # /role-specific:writefreely

hubsite_service_list_auto: "{{ mash_playbook_hubsite_service_list_auto_itemized | reject('equalto', omit) }}"

########################################################################
#                                                                      #
# /hubsite                                                             #
#                                                                      #
########################################################################
# /role-specific:hubsite



# role-specific:ilmo
########################################################################
#                                                                      #
# ilmo                                                                 #
#                                                                      #
########################################################################

ilmo_enabled: false

ilmo_identifier: "{{ mash_playbook_service_identifier_prefix }}ilmo"

ilmo_base_path: "{{ mash_playbook_base_path }}/{{ mash_playbook_service_base_directory_name_prefix }}ilmo"

ilmo_uid: "{{ mash_playbook_uid }}"
ilmo_gid: "{{ mash_playbook_gid }}"

ilmo_secret: "{{ '%s' | format(mash_playbook_generic_secret_key) | password_hash('sha512', 'secret.ilmo', rounds=655555) | to_uuid }}"

ilmo_database_host: "{{ devture_postgres_identifier if devture_postgres_enabled else '' }}"
ilmo_database_port: "{{ '5432' if devture_postgres_enabled else '' }}"
ilmo_database_password: "{{ '%s' | format(mash_playbook_generic_secret_key) | password_hash('sha512', 'db.ilmo', rounds=655555) | to_uuid }}"
ilmo_database_username: "ilmo"

ilmo_systemd_required_services_list: |
  {{
    ([devture_systemd_docker_base_docker_service_name] if devture_systemd_docker_base_docker_service_name else [])
    +
    ([devture_postgres_identifier ~ '.service'] if devture_postgres_enabled and ilmo_database_host == devture_postgres_identifier else [])
  }}

ilmo_container_additional_networks: |
  {{
    ([mash_playbook_reverse_proxyable_services_additional_network] if mash_playbook_reverse_proxyable_services_additional_network else [])
    +
    ([devture_postgres_container_network] if devture_postgres_enabled and ilmo_database_host == devture_postgres_identifier and ilmo_container_network != devture_postgres_container_network else [])
  }}

ilmo_container_labels_traefik_enabled: "{{ mash_playbook_traefik_labels_enabled }}"
ilmo_container_labels_traefik_docker_network: "{{ mash_playbook_reverse_proxyable_services_additional_network }}"
ilmo_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
ilmo_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}"

########################################################################
#                                                                      #
# /ilmo                                                                #
#                                                                      #
########################################################################
# /role-specific:ilmo



# role-specific:infisical
########################################################################
#                                                                      #
# infisical                                                            #
#                                                                      #
########################################################################

infisical_enabled: false

infisical_identifier: "{{ mash_playbook_service_identifier_prefix }}infisical"

infisical_base_path: "{{ mash_playbook_base_path }}/{{ mash_playbook_service_base_directory_name_prefix }}infisical"

infisical_uid: "{{ mash_playbook_uid }}"
infisical_gid: "{{ mash_playbook_gid }}"

infisical_backend_systemd_required_services_list: |
  {{
    ([devture_systemd_docker_base_docker_service_name] if devture_systemd_docker_base_docker_service_name else [])
    +
    ([mongodb_identifier ~ '.service'] if mongodb_enabled and infisical_mongodb_hostname == mongodb_identifier else [])
  }}

infisical_backend_container_additional_networks: |
  {{
    ([mash_playbook_reverse_proxyable_services_additional_network] if mash_playbook_reverse_proxyable_services_additional_network else [])
    +
    ([mongodb_container_network] if mongodb_enabled and infisical_mongodb_hostname == mongodb_identifier and infisical_backend_container_network != mongodb_container_network else [])
  }}

infisical_backend_container_labels_traefik_enabled: "{{ mash_playbook_traefik_labels_enabled }}"
infisical_backend_container_labels_traefik_docker_network: "{{ mash_playbook_reverse_proxyable_services_additional_network }}"
infisical_backend_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
infisical_backend_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}"

# Intentionally not auto-generating infisical_backend_environment_variable_encryption_key here.
# We prefer it to be explicit as it seems important that it remains stable.

infisical_backend_environment_variable_jwt_signup_secret: "{{ ('%s' | format(mash_playbook_generic_secret_key) | password_hash('sha512', 'inf.jwt.signup', rounds=655555) | to_uuid | replace('-', ''))[0:32] }}"
infisical_backend_environment_variable_jwt_refresh_secret: "{{ ('%s' | format(mash_playbook_generic_secret_key) | password_hash('sha512', 'inf.jwt.r', rounds=655555) | to_uuid | replace('-', ''))[0:32] }}"
infisical_backend_environment_variable_jwt_auth_secret: "{{ ('%s' | format(mash_playbook_generic_secret_key) | password_hash('sha512', 'inf.jwt.a', rounds=655555) | to_uuid | replace('-', ''))[0:32] }}"
infisical_backend_environment_variable_jwt_service_secret: "{{ ('%s' | format(mash_playbook_generic_secret_key) | password_hash('sha512', 'inf.jwt.svc', rounds=655555) | to_uuid | replace('-', ''))[0:32] }}"

infisical_frontend_container_additional_networks: |
  {{
    ([mash_playbook_reverse_proxyable_services_additional_network] if mash_playbook_reverse_proxyable_services_additional_network else [])
  }}

infisical_frontend_container_labels_traefik_enabled: "{{ mash_playbook_traefik_labels_enabled }}"
infisical_frontend_container_labels_traefik_docker_network: "{{ mash_playbook_reverse_proxyable_services_additional_network }}"
infisical_frontend_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
infisical_frontend_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}"

infisical_mongodb_hostname: "{{ mongodb_identifier if mongodb_enabled else '' }}"
infisical_mongodb_password: "{{ '%s' | format(mash_playbook_generic_secret_key) | password_hash('sha512', 'infisical.db', rounds=655555) | to_uuid }}"
infisical_mongodb_auth_source: "{{ infisical_mongodb_db_name }}"

########################################################################
#                                                                      #
# /infisical                                                           #
#                                                                      #
########################################################################
# /role-specific:infisical




# role-specific:influxdb
########################################################################
#                                                                      #
# influxdb                                                             #
#                                                                      #
########################################################################

influxdb_enabled: false

influxdb_identifier: "{{ mash_playbook_service_identifier_prefix }}influxdb"

influxdb_base_path: "{{ mash_playbook_base_path }}/{{ mash_playbook_service_base_directory_name_prefix }}influxdb"

influxdb_uid: "{{ mash_playbook_uid }}"
influxdb_gid: "{{ mash_playbook_gid }}"

influxdb_container_additional_networks_auto: |
  {{
    ([mash_playbook_reverse_proxyable_services_additional_network] if (influxdb_container_labels_traefik_enabled and mash_playbook_reverse_proxyable_services_additional_network) else [])
  }}

influxdb_container_labels_traefik_enabled: "{{ mash_playbook_traefik_labels_enabled }}"
influxdb_container_labels_traefik_docker_network: "{{ mash_playbook_reverse_proxyable_services_additional_network }}"
influxdb_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
influxdb_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}"

########################################################################
#                                                                      #
# /influxdb                                                            #
#                                                                      #
########################################################################
# /role-specific:influxdb



# role-specific:jitsi
########################################################################
#                                                                      #
# jitsi                                                                #
#                                                                      #
########################################################################

jitsi_enabled: false

jitsi_architecture: "{{ mash_playbook_architecture }}"

jitsi_identifier: "{{ mash_playbook_service_identifier_prefix }}jitsi"

jitsi_base_path: "{{ mash_playbook_base_path }}/{{ mash_playbook_service_base_directory_name_prefix }}jitsi"

jitsi_uid: "{{ mash_playbook_uid }}"
jitsi_gid: "{{ mash_playbook_gid }}"

jitsi_user_username: "{{ mash_playbook_user_username }}"

jitsi_web_container_additional_networks_auto: |
  {{
    ([mash_playbook_reverse_proxyable_services_additional_network] if mash_playbook_reverse_proxyable_services_additional_network else [])
  }}

jitsi_prosody_container_additional_networks_auto: |
  {{
    ([mash_playbook_reverse_proxyable_services_additional_network] if mash_playbook_reverse_proxyable_services_additional_network else [])
  }}

jitsi_jvb_container_additional_networks_auto: |
  {{
    ([mash_playbook_reverse_proxyable_services_additional_network] if mash_playbook_reverse_proxyable_services_additional_network else [])
  }}

jitsi_container_labels_traefik_enabled: "{{ mash_playbook_traefik_labels_enabled }}"
jitsi_container_labels_traefik_docker_network: "{{ mash_playbook_reverse_proxyable_services_additional_network }}"
jitsi_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
jitsi_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}"

jitsi_jibri_xmpp_password: "{{ '%s' | format(mash_playbook_generic_secret_key) | password_hash('sha512', 'jibri', rounds=655555) | to_uuid }}"
jitsi_jicofo_auth_password: "{{ '%s' | format(mash_playbook_generic_secret_key) | password_hash('sha512', 'jicofo', rounds=655555) | to_uuid }}"
jitsi_jvb_auth_password: "{{ '%s' | format(mash_playbook_generic_secret_key) | password_hash('sha512', 'jvb', rounds=655555) | to_uuid }}"

########################################################################
#                                                                      #
# /jitsi                                                               #
#                                                                      #
########################################################################
# /role-specific:jitsi



# role-specific:keycloak
########################################################################
#                                                                      #
# keycloak                                                             #
#                                                                      #
########################################################################

keycloak_enabled: false

keycloak_identifier: "{{ mash_playbook_service_identifier_prefix }}keycloak"

keycloak_uid: "{{ mash_playbook_uid }}"
keycloak_gid: "{{ mash_playbook_gid }}"

keycloak_base_path: "{{ mash_playbook_base_path }}/{{ mash_playbook_service_base_directory_name_prefix }}keycloak"

keycloak_systemd_required_systemd_services_list_auto: |
  {{
    ([devture_postgres_identifier ~ '.service'] if devture_postgres_enabled and keycloak_database_hostname == devture_postgres_identifier else [])
  }}

keycloak_container_additional_networks_auto: |
  {{
    ([mash_playbook_reverse_proxyable_services_additional_network] if mash_playbook_reverse_proxyable_services_additional_network else [])
    +
    ([devture_postgres_container_network] if devture_postgres_enabled and keycloak_database_hostname == devture_postgres_identifier and keycloak_container_network != devture_postgres_container_network else [])
  }}

keycloak_container_labels_traefik_enabled: "{{ mash_playbook_traefik_labels_enabled }}"
keycloak_container_labels_traefik_docker_network: "{{ mash_playbook_reverse_proxyable_services_additional_network }}"
keycloak_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
keycloak_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}"

keycloak_container_labels_metrics_hostname: "{{ mash_playbook_metrics_exposure_hostname }}"
keycloak_container_labels_metrics_path_prefix: "{{ mash_playbook_metrics_exposure_path_prefix }}/{{ keycloak_identifier }}"
keycloak_container_labels_metrics_middleware_basic_auth_enabled: "{{ mash_playbook_metrics_exposure_http_basic_auth_enabled }}"
keycloak_container_labels_metrics_middleware_basic_auth_users: "{{ mash_playbook_metrics_exposure_http_basic_auth_users }}"

keycloak_environment_variable_kc_metrics_enabled: "{{ prometheus_enabled | default(false) or mash_playbook_metrics_exposure_enabled }}"

keycloak_database_hostname: "{{ devture_postgres_identifier if devture_postgres_enabled else '' }}"
keycloak_database_port: "{{ '5432' if devture_postgres_enabled else '' }}"
keycloak_database_password: "{{ '%s' | format(mash_playbook_generic_secret_key) | password_hash('sha512', 'db.keycloak', rounds=655555) | to_uuid }}"

########################################################################
#                                                                      #
# /keycloak                                                            #
#                                                                      #
########################################################################
# /role-specific:keycloak



# role-specific:lago
########################################################################
#                                                                      #
# lago                                                                 #
#                                                                      #
########################################################################

lago_enabled: false

lago_architecture: "{{ mash_playbook_architecture }}"

lago_identifier: "{{ mash_playbook_service_identifier_prefix }}lago"

lago_base_path: "{{ mash_playbook_base_path }}/{{ mash_playbook_service_base_directory_name_prefix }}lago"

lago_uid: "{{ mash_playbook_uid }}"
lago_gid: "{{ mash_playbook_gid }}"

lago_api_container_additional_networks_auto: |
  {{
    ([mash_playbook_reverse_proxyable_services_additional_network] if mash_playbook_reverse_proxyable_services_additional_network else [])
    +
    ([devture_postgres_container_network] if devture_postgres_enabled and lago_database_hostname == devture_postgres_identifier and lago_api_container_network != devture_postgres_container_network else [])
  }}

lago_front_container_additional_networks_auto: |
  {{
    ([mash_playbook_reverse_proxyable_services_additional_network] if mash_playbook_reverse_proxyable_services_additional_network else [])
  }}

lago_container_labels_traefik_enabled: "{{ mash_playbook_traefik_labels_enabled }}"
lago_container_labels_traefik_docker_network: "{{ mash_playbook_reverse_proxyable_services_additional_network }}"
lago_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
lago_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}"

lago_database_hostname: "{{ devture_postgres_identifier if devture_postgres_enabled else '' }}"
lago_database_port: "{{ '5432' if devture_postgres_enabled else '' }}"
lago_database_password: "{{ '%s' | format(mash_playbook_generic_secret_key) | password_hash('sha512', 'lago.db', rounds=655555) | to_uuid }}"

lago_api_environment_variable_secret_key_base: "{{ '%s' | format(mash_playbook_generic_secret_key) | password_hash('sha512', 'lago.sec.key', rounds=655555) | to_uuid }}"
lago_api_environment_variable_encryption_primary_key: "{{ '%s' | format(mash_playbook_generic_secret_key) | password_hash('sha512', 'lago.enc.primary', rounds=655555) | to_uuid }}"
lago_api_environment_variable_encryption_deterministic_key: "{{ '%s' | format(mash_playbook_generic_secret_key) | password_hash('sha512', 'lago.deter.key', rounds=655555) | to_uuid }}"
lago_api_environment_variable_encryption_key_derivation_salt: "{{ '%s' | format(mash_playbook_generic_secret_key) | password_hash('sha512', 'lago.deriv.salt', rounds=655555) | to_uuid }}"

########################################################################
#                                                                      #
# /lago                                                                #
#                                                                      #
########################################################################
# /role-specific:lago



# role-specific:languagetool
########################################################################
#                                                                      #
# languagetool                                                         #
#                                                                      #
########################################################################

languagetool_enabled: false

languagetool_identifier: "{{ mash_playbook_service_identifier_prefix }}languagetool"

languagetool_base_path: "{{ mash_playbook_base_path }}/{{ mash_playbook_service_base_directory_name_prefix }}languagetool"

languagetool_uid: "{{ mash_playbook_uid }}"
languagetool_gid: "{{ mash_playbook_gid }}"

languagetool_container_labels_traefik_enabled: "{{ mash_playbook_traefik_labels_enabled }}"
languagetool_container_labels_traefik_docker_network: "{{ mash_playbook_reverse_proxyable_services_additional_network }}"
languagetool_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
languagetool_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}"

languagetool_container_additional_networks_auto: |
  {{
    ([mash_playbook_reverse_proxyable_services_additional_network] if mash_playbook_reverse_proxyable_services_additional_network else [])
  }}

########################################################################
#                                                                      #
# /languagetool                                                        #
#                                                                      #
########################################################################
# /role-specific:languagetool



# role-specific:loki
########################################################################
#                                                                      #
# loki                                                                 #
#                                                                      #
########################################################################

loki_enabled: false

loki_identifier: "{{ mash_playbook_service_identifier_prefix }}loki"

loki_base_path: "{{ mash_playbook_base_path }}/{{ mash_playbook_service_base_directory_name_prefix }}loki"

loki_uid: "{{ mash_playbook_uid }}"
loki_gid: "{{ mash_playbook_gid }}"

# Only enable Traefik labels if a hostname is set (indicating that this will be exposed publicly)
loki_container_labels_traefik_enabled: "{{ mash_playbook_traefik_labels_enabled and loki_hostname | length > 0 }}"
loki_container_labels_traefik_docker_network: "{{ mash_playbook_reverse_proxyable_services_additional_network }}"
loki_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
loki_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}"

loki_container_additional_networks_auto: |
  {{
    ([mash_playbook_reverse_proxyable_services_additional_network] if mash_playbook_reverse_proxyable_services_additional_network else [])
  }}

########################################################################
#                                                                      #
# /loki                                                                #
#                                                                      #
########################################################################
# /role-specific:loki



# role-specific:linkding
########################################################################
#                                                                      #
# linkding                                                             #
#                                                                      #
########################################################################

linkding_enabled: false

linkding_identifier: "{{ mash_playbook_service_identifier_prefix }}linkding"

linkding_base_path: "{{ mash_playbook_base_path }}/{{ mash_playbook_service_base_directory_name_prefix }}linkding"

linkding_uid: "{{ mash_playbook_uid }}"
linkding_gid: "{{ mash_playbook_gid }}"

linkding_systemd_required_services_list: |
  {{
    ([devture_systemd_docker_base_docker_service_name] if devture_systemd_docker_base_docker_service_name else [])
    +
    ([devture_postgres_identifier ~ '.service'] if devture_postgres_enabled and linkding_database_hostname == devture_postgres_identifier else [])
  }}

linkding_container_additional_networks: |
  {{
    ([mash_playbook_reverse_proxyable_services_additional_network] if mash_playbook_reverse_proxyable_services_additional_network else [])
    +
    ([devture_postgres_container_network] if devture_postgres_enabled and linkding_database_hostname == devture_postgres_identifier and linkding_container_network != devture_postgres_container_network else [])
  }}

linkding_container_labels_traefik_enabled: "{{ mash_playbook_traefik_labels_enabled }}"
linkding_container_labels_traefik_docker_network: "{{ mash_playbook_reverse_proxyable_services_additional_network }}"
linkding_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
linkding_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}"

linkding_database_hostname: "{{ devture_postgres_connection_hostname if devture_postgres_enabled else '' }}"
linkding_database_password: "{{ '%s' | format(mash_playbook_generic_secret_key) | password_hash('sha512', 'linkding.db', rounds=655555) | to_uuid }}"
linkding_database_engine: "{{ 'postgres' if devture_postgres_enabled and linkding_database_hostname == devture_postgres_connection_hostname else 'sqlite' }}"

########################################################################
#                                                                      #
# /linkding                                                            #
#                                                                      #
########################################################################
# /role-specific:linkding



# role-specific:miniflux
########################################################################
#                                                                      #
# miniflux                                                             #
#                                                                      #
########################################################################

miniflux_enabled: false

miniflux_identifier: "{{ mash_playbook_service_identifier_prefix }}miniflux"

miniflux_base_path: "{{ mash_playbook_base_path }}/{{ mash_playbook_service_base_directory_name_prefix }}miniflux"

miniflux_uid: "{{ mash_playbook_uid }}"
miniflux_gid: "{{ mash_playbook_gid }}"

miniflux_systemd_required_services_list: |
  {{
    ([devture_systemd_docker_base_docker_service_name] if devture_systemd_docker_base_docker_service_name else [])
    +
    ([devture_postgres_identifier ~ '.service'] if devture_postgres_enabled and miniflux_database_hostname == devture_postgres_identifier else [])
  }}

miniflux_container_additional_networks: |
  {{
    ([mash_playbook_reverse_proxyable_services_additional_network] if mash_playbook_reverse_proxyable_services_additional_network else [])
    +
    ([devture_postgres_container_network] if devture_postgres_enabled and miniflux_database_hostname == devture_postgres_identifier and miniflux_container_network != devture_postgres_container_network else [])
  }}

miniflux_container_labels_traefik_enabled: "{{ mash_playbook_traefik_labels_enabled }}"
miniflux_container_labels_traefik_docker_network: "{{ mash_playbook_reverse_proxyable_services_additional_network }}"
miniflux_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
miniflux_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}"

miniflux_database_hostname: "{{ devture_postgres_connection_hostname if devture_postgres_enabled else '' }}"
miniflux_database_password: "{{ '%s' | format(mash_playbook_generic_secret_key) | password_hash('sha512', 'miniflux.db', rounds=655555) | to_uuid }}"

########################################################################
#                                                                      #
# /miniflux                                                            #
#                                                                      #
########################################################################
# /role-specific:miniflux



# role-specific:mobilizon
########################################################################
#                                                                      #
# mobilizon                                                            #
#                                                                      #
########################################################################

mobilizon_enabled: false

mobilizon_identifier: "{{ mash_playbook_service_identifier_prefix }}mobilizon"

mobilizon_base_path: "{{ mash_playbook_base_path }}/{{ mash_playbook_service_base_directory_name_prefix }}mobilizon"

mobilizon_uid: "{{ mash_playbook_uid }}"
mobilizon_gid: "{{ mash_playbook_gid }}"

mobilizon_secret_key: "{{ '%s' | format(mash_playbook_generic_secret_key) | password_hash('sha512', 'sk.mobilizon', rounds=655555) | to_uuid }}"
mobilizon_secret_key_base: "{{ '%s' | format(mash_playbook_generic_secret_key) | password_hash('sha512', 'skb.mobilizon', rounds=655555) | to_uuid }}"

mobilizon_database_hostname: "{{ postgis_identifier if postgis_enabled else '' }}"
mobilizon_database_name: "mobilizon"
mobilizon_database_port: "{{ '5432' if postgis_enabled else '' }}"
mobilizon_database_password: "{{ '%s' | format(mash_playbook_generic_secret_key) | password_hash('sha512', 'db.mobilizon', rounds=655555) | to_uuid }}"
mobilizon_database_username: "mobilizon"

mobilizon_systemd_required_services_list: |
  {{
    ([devture_systemd_docker_base_docker_service_name] if devture_systemd_docker_base_docker_service_name else [])
    +
    ([postgis_identifier ~ '.service'] if postgis_enabled and mobilizon_database_hostname == postgis_identifier else [])
  }}

mobilizon_container_additional_networks: |
  {{
    ([mash_playbook_reverse_proxyable_services_additional_network] if mash_playbook_reverse_proxyable_services_additional_network else [])
    +
    ([postgis_container_network] if postgis_enabled and mobilizon_database_hostname == postgis_identifier and mobilizon_container_network != postgis_container_network else [])
  }}

mobilizon_container_labels_traefik_enabled: "{{ mash_playbook_traefik_labels_enabled }}"
mobilizon_container_labels_traefik_docker_network: "{{ mash_playbook_reverse_proxyable_services_additional_network }}"
mobilizon_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
mobilizon_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}"

########################################################################
#                                                                      #
# /mobilizon                                                           #
#                                                                      #
########################################################################
# /role-specific:mobilizon



# role-specific:mongodb
########################################################################
#                                                                      #
# mongodb                                                              #
#                                                                      #
########################################################################

mongodb_enabled: false

mongodb_identifier: "{{ mash_playbook_service_identifier_prefix }}mongodb"

mongodb_uid: "{{ mash_playbook_uid }}"
mongodb_gid: "{{ mash_playbook_gid }}"

mongodb_base_path: "{{ mash_playbook_base_path }}/{{ mash_playbook_service_base_directory_name_prefix }}mongodb"

mongodb_managed_databases_auto: |
  {{
    ([{
      'name': infisical_mongodb_db_name,
      'username': infisical_mongodb_username,
      'password': infisical_mongodb_password,
    }] if infisical_enabled and infisical_mongodb_hostname == mongodb_identifier else [])
  }}

########################################################################
#                                                                      #
# /mongodb                                                             #
#                                                                      #
########################################################################
# /role-specific:mongodb


# role-specific:mosquitto
########################################################################
#                                                                      #
# mosquitto                                                            #
#                                                                      #
########################################################################

mosquitto_enabled: false

mosquitto_identifier: "{{ mash_playbook_service_identifier_prefix }}mosquitto"

mosquitto_base_path: "{{ mash_playbook_base_path }}/{{ mash_playbook_service_base_directory_name_prefix }}mosquitto"

mosquitto_uid: "{{ mash_playbook_uid }}"
mosquitto_gid: "{{ mash_playbook_gid }}"

########################################################################
#                                                                      #
# /mosquitto                                                           #
#                                                                      #
########################################################################
# /role-specific:mosquitto


# role-specific:mrs
########################################################################
#                                                                      #
# mrs                                                                  #
#                                                                      #
########################################################################

mrs_enabled: false

mrs_identifier: "{{ mash_playbook_service_identifier_prefix }}mrs"

mrs_base_path: "{{ mash_playbook_base_path }}/{{ mash_playbook_service_base_directory_name_prefix }}mrs"

mrs_uid: "{{ mash_playbook_uid }}"
mrs_gid: "{{ mash_playbook_gid }}"

mrs_container_additional_networks: |
  {{
    ([mash_playbook_reverse_proxyable_services_additional_network] if mash_playbook_reverse_proxyable_services_additional_network else [])
  }}

mrs_container_labels_traefik_enabled: "{{ mash_playbook_traefik_labels_enabled }}"
mrs_container_labels_traefik_docker_network: "{{ mash_playbook_reverse_proxyable_services_additional_network }}"
mrs_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
mrs_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}"

########################################################################
#                                                                      #
# /mrs                                                                 #
#                                                                      #
########################################################################
# /role-specific:mrs



# role-specific:n8n
########################################################################
#                                                                      #
# n8n                                                                  #
#                                                                      #
########################################################################

n8n_enabled: false

n8n_identifier: "{{ mash_playbook_service_identifier_prefix }}n8n"

n8n_base_path: "{{ mash_playbook_base_path }}/{{ mash_playbook_service_base_directory_name_prefix }}n8n"

# Please see the note attached to this comment on why we can't use mash's playbook uid and gid
# https://github.com/kinduff/ansible-docker-n8n/blob/v1.4.2/defaults/main.yml
n8n_uid: "1000"
n8n_gid: "1000"

n8n_systemd_required_services_list: |
  {{
    ([devture_systemd_docker_base_docker_service_name] if devture_systemd_docker_base_docker_service_name else [])
    +
    ([devture_postgres_identifier ~ '.service'] if devture_postgres_enabled and n8n_database_hostname == devture_postgres_identifier else [])
  }}

n8n_container_additional_networks: |
  {{
    ([mash_playbook_reverse_proxyable_services_additional_network] if mash_playbook_reverse_proxyable_services_additional_network else [])
    +
    ([devture_postgres_container_network] if devture_postgres_enabled and n8n_database_hostname == devture_postgres_identifier and n8n_container_network != devture_postgres_container_network else [])
  }}

n8n_container_labels_traefik_enabled: "{{ mash_playbook_traefik_labels_enabled }}"
n8n_container_labels_traefik_docker_network: "{{ mash_playbook_reverse_proxyable_services_additional_network }}"
n8n_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
n8n_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}"

n8n_database_hostname: "{{ devture_postgres_connection_hostname if devture_postgres_enabled else '' }}"
n8n_database_password: "{{ '%s' | format(mash_playbook_generic_secret_key) | password_hash('sha512', 'n8n.db', rounds=655555) | to_uuid }}"

########################################################################
#                                                                      #
# /n8n                                                                 #
#                                                                      #
########################################################################
# /role-specific:n8n



# role-specific:navidrome
########################################################################
#                                                                      #
# navidrome                                                            #
#                                                                      #
########################################################################

navidrome_enabled: false

navidrome_identifier: "{{ mash_playbook_service_identifier_prefix }}navidrome"

navidrome_uid: "{{ mash_playbook_uid }}"
navidrome_gid: "{{ mash_playbook_gid }}"

navidrome_base_path: "{{ mash_playbook_base_path }}/{{ mash_playbook_service_base_directory_name_prefix }}navidrome"

navidrome_container_additional_networks_auto: |
  {{
    ([mash_playbook_reverse_proxyable_services_additional_network] if mash_playbook_reverse_proxyable_services_additional_network else [])
  }}

navidrome_container_labels_traefik_enabled: "{{ mash_playbook_traefik_labels_enabled }}"
navidrome_container_labels_traefik_docker_network: "{{ mash_playbook_reverse_proxyable_services_additional_network }}"
navidrome_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
navidrome_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}"

########################################################################
#                                                                      #
# /navidrome                                                           #
#                                                                      #
########################################################################
# /role-specific:navidrome


# role-specific:neko
########################################################################
#                                                                      #
# neko                                                                 #
#                                                                      #
########################################################################

neko_enabled: false

neko_identifier: "{{ mash_playbook_service_identifier_prefix }}neko"

neko_uid: "{{ mash_playbook_uid }}"
neko_gid: "{{ mash_playbook_gid }}"

neko_base_path: "{{ mash_playbook_base_path }}/{{ mash_playbook_service_base_directory_name_prefix }}neko"

neko_container_additional_networks_auto: |
  {{
    ([mash_playbook_reverse_proxyable_services_additional_network] if mash_playbook_reverse_proxyable_services_additional_network else [])
  }}

neko_container_labels_traefik_enabled: "{{ mash_playbook_traefik_labels_enabled }}"
neko_container_labels_traefik_docker_network: "{{ mash_playbook_reverse_proxyable_services_additional_network }}"
neko_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
neko_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}"

########################################################################
#                                                                      #
# /neko                                                                #
#                                                                      #
########################################################################
# /role-specific:neko



# role-specific:nextcloud
########################################################################
#                                                                      #
# nextcloud                                                            #
#                                                                      #
########################################################################

nextcloud_enabled: false

nextcloud_identifier: "{{ mash_playbook_service_identifier_prefix }}nextcloud"

nextcloud_base_path: "{{ mash_playbook_base_path }}/{{ mash_playbook_service_base_directory_name_prefix }}nextcloud"

nextcloud_uid: "{{ mash_playbook_uid }}"
nextcloud_gid: "{{ mash_playbook_gid }}"

nextcloud_systemd_required_services_list_auto: |
  {{
    ([devture_postgres_identifier ~ '.service'] if devture_postgres_enabled and nextcloud_database_hostname == devture_postgres_identifier else [])
  }}

nextcloud_systemd_wanted_services_list_auto: |
  {{
    ([(exim_relay_identifier | default('mash-exim-relay')) ~ '.service'] if (exim_relay_enabled | default(false) and nextcloud_config_parameter_mail_smtphost == exim_relay_identifier | default('mash-exim-relay')) else [])
  }}

nextcloud_container_additional_networks_auto: |
  {{
    (
      ([mash_playbook_reverse_proxyable_services_additional_network] if mash_playbook_reverse_proxyable_services_additional_network else [])
      +
      ([devture_postgres_container_network] if devture_postgres_enabled and nextcloud_database_hostname == devture_postgres_identifier and nextcloud_container_network != devture_postgres_container_network else [])
    +
    ([exim_relay_container_network | default('mash-exim-relay')] if (exim_relay_enabled | default(false) and nextcloud_config_parameter_mail_smtphost == exim_relay_identifier | default('mash-exim-relay') and nextcloud_container_network != exim_relay_container_network) else [])
    ) | unique
  }}

nextcloud_container_labels_traefik_enabled: "{{ mash_playbook_traefik_labels_enabled }}"
nextcloud_container_labels_traefik_docker_network: "{{ mash_playbook_reverse_proxyable_services_additional_network }}"
nextcloud_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
nextcloud_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}"

nextcloud_database_hostname: "{{ devture_postgres_identifier if devture_postgres_enabled else '' }}"
nextcloud_database_port: "{{ '5432' if devture_postgres_enabled else '' }}"
nextcloud_database_username: "nextcloud"
nextcloud_database_password: "{{ '%s' | format(mash_playbook_generic_secret_key) | password_hash('sha512', 'db.nextcloud', rounds=655555) | to_uuid }}"

# role-specific:exim_relay
nextcloud_config_parameter_mail_smtphost: "{{ exim_relay_identifier if exim_relay_enabled else '' }}"
nextcloud_config_parameter_mail_smtpport: "{{ 8025 if exim_relay_enabled else '' }}"
nextcloud_config_parameter_mail_smtpsecure: ''
nextcloud_config_parameter_mail_smtpauth: false
nextcloud_config_parameter_mail_from_address: "{{ (exim_relay_sender_address | split('@'))[0] if exim_relay_enabled else '' }}"
nextcloud_config_parameter_mail_domain: "{{ (exim_relay_sender_address | split('@'))[1] if exim_relay_enabled else '' }}"
# /role-specific:exim_relay

########################################################################
#                                                                      #
# /nextcloud                                                           #
#                                                                      #
########################################################################
# /role-specific:nextcloud



# role-specific:netbox
########################################################################
#                                                                      #
# netbox                                                               #
#                                                                      #
########################################################################

netbox_enabled: false

netbox_identifier: "{{ mash_playbook_service_identifier_prefix }}netbox"

netbox_uid: "{{ mash_playbook_uid }}"
netbox_gid: "{{ mash_playbook_gid }}"

netbox_base_path: "{{ mash_playbook_base_path }}/{{ mash_playbook_service_base_directory_name_prefix }}netbox"

netbox_systemd_required_services_list_auto: |
  {{
    ([devture_postgres_identifier ~ '.service'] if devture_postgres_enabled and netbox_database_hostname == devture_postgres_identifier else [])
  }}

netbox_container_additional_networks_auto: |
  {{
    (
      ([mash_playbook_reverse_proxyable_services_additional_network] if mash_playbook_reverse_proxyable_services_additional_network else [])
      +
      ([devture_postgres_container_network] if devture_postgres_enabled and netbox_database_hostname == devture_postgres_identifier and netbox_container_network != devture_postgres_container_network else [])
    ) | unique
  }}

netbox_container_labels_traefik_enabled: "{{ mash_playbook_traefik_labels_enabled }}"
netbox_container_labels_traefik_docker_network: "{{ mash_playbook_reverse_proxyable_services_additional_network }}"
netbox_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
netbox_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}"

netbox_database_hostname: "{{ devture_postgres_identifier if devture_postgres_enabled else '' }}"
netbox_database_port: "{{ '5432' if devture_postgres_enabled else '' }}"
netbox_database_password: "{{ '%s' | format(mash_playbook_generic_secret_key) | password_hash('sha512', 'db.netbox', rounds=655555) | to_uuid }}"

########################################################################
#                                                                      #
# /netbox                                                              #
#                                                                      #
########################################################################
# /role-specific:netbox



# role-specific:mariadb
########################################################################
#                                                                      #
# mariadb                                                              #
#                                                                      #
########################################################################

mariadb_enabled: false

mariadb_identifier: "{{ mash_playbook_service_identifier_prefix }}mariadb"

mariadb_base_path: "{{ mash_playbook_base_path }}/{{ mash_playbook_service_base_directory_name_prefix }}mariadb"

mariadb_uid: "{{ mash_playbook_uid }}"
mariadb_gid: "{{ mash_playbook_gid }}"

mash_playbook_mariadb_managed_databases_auto_itemized:
  # Dummy entry, which is not role-specific.
  # Ensures there's at least one entry defined in the list.
  - "{{ omit }}"

  # role-specific:authelia
  - |-
    {{
      ({
        'name': authelia_config_storage_mysql_database,
        'username': authelia_config_storage_mysql_username,
        'password': authelia_config_storage_mysql_password,
      } if authelia_enabled and authelia_config_storage_mysql_host == mariadb_identifier else omit)
    }}
  # /role-specific:authelia

  # role-specific:wordpress
  - |-
    {{
      ({
        'name': wordpress_database_name,
        'username': wordpress_database_username,
        'password': wordpress_database_password,
      } if wordpress_enabled and wordpress_database_hostname == mariadb_identifier | default('mash-mariadb') else omit)
    }}
  # /role-specific:wordpress

mariadb_managed_databases_auto: "{{ mash_playbook_mariadb_managed_databases_auto_itemized | reject('equalto', omit) }}"

########################################################################
#                                                                      #
# /mariadb                                                             #
#                                                                      #
########################################################################
# /role-specific:mariadb



# role-specific:notfellchen
########################################################################
#                                                                      #
# notfellchen                                                          #
#                                                                      #
########################################################################

notfellchen_enabled: false

notfellchen_identifier: "{{ mash_playbook_service_identifier_prefix }}notfellchen"

notfellchen_base_path: "{{ mash_playbook_base_path }}/{{ mash_playbook_service_base_directory_name_prefix }}notfellchen"

notfellchen_uid: "{{ mash_playbook_uid }}"
notfellchen_gid: "{{ mash_playbook_gid }}"

notfellchen_secret: "{{ '%s' | format(mash_playbook_generic_secret_key) | password_hash('sha512', 'secret.nf', rounds=655555) | to_uuid }}"

notfellchen_database_host: "{{ devture_postgres_identifier if devture_postgres_enabled else '' }}"
notfellchen_database_port: "{{ '5432' if devture_postgres_enabled else '' }}"
notfellchen_database_password: "{{ '%s' | format(mash_playbook_generic_secret_key) | password_hash('sha512', 'db.nf', rounds=655555) | to_uuid }}"
notfellchen_database_username: "notfellchen"

notfellchen_systemd_required_services_list: |
  {{
    ([devture_systemd_docker_base_docker_service_name] if devture_systemd_docker_base_docker_service_name else [])
    +
    ([devture_postgres_identifier ~ '.service'] if devture_postgres_enabled and notfellchen_database_host == devture_postgres_identifier else [])
  }}

notfellchen_container_additional_networks: |
  {{
    ([mash_playbook_reverse_proxyable_services_additional_network] if mash_playbook_reverse_proxyable_services_additional_network else [])
    +
    ([devture_postgres_container_network] if devture_postgres_enabled and notfellchen_database_host == devture_postgres_identifier and notfellchen_container_network != devture_postgres_container_network else [])
  }}

notfellchen_container_labels_traefik_enabled: "{{ mash_playbook_traefik_labels_enabled }}"
notfellchen_container_labels_traefik_docker_network: "{{ mash_playbook_reverse_proxyable_services_additional_network }}"
notfellchen_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
notfellchen_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}"

notfellchen_sws_container_labels_traefik_enabled: "{{ notfellchen_container_labels_traefik_enabled }}"
notfellchen_sws_container_labels_traefik_docker_network: "{{ notfellchen_container_labels_traefik_docker_network }}"
notfellchen_sws_container_labels_traefik_entrypoints: "{{ notfellchen_container_labels_traefik_entrypoints }}"
notfellchen_sws_container_labels_traefik_tls_certResolver: "{{ notfellchen_container_labels_traefik_tls_certResolver }}"


########################################################################
#                                                                      #
# /notfellchen                                                         #
#                                                                      #
########################################################################
# /role-specific:notfellchen



# role-specific:outline
########################################################################
#                                                                      #
# outline                                                              #
#                                                                      #
########################################################################

outline_enabled: false

outline_identifier: "{{ mash_playbook_service_identifier_prefix }}outline"

outline_uid: "{{ mash_playbook_uid }}"
outline_gid: "{{ mash_playbook_gid }}"

outline_base_path: "{{ mash_playbook_base_path }}/{{ mash_playbook_service_base_directory_name_prefix }}outline"

outline_systemd_required_services_list_auto: |
  {{
    ([devture_postgres_identifier ~ '.service'] if devture_postgres_enabled and outline_database_hostname == devture_postgres_identifier else [])
  }}

outline_container_additional_networks_auto: |
  {{
    ([mash_playbook_reverse_proxyable_services_additional_network] if mash_playbook_reverse_proxyable_services_additional_network else [])
    +
    ([devture_postgres_container_network] if devture_postgres_enabled and outline_database_hostname == devture_postgres_identifier and outline_container_network != devture_postgres_container_network else [])
  }}

outline_container_labels_traefik_enabled: "{{ mash_playbook_traefik_labels_enabled }}"
outline_container_labels_traefik_docker_network: "{{ mash_playbook_reverse_proxyable_services_additional_network }}"
outline_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
outline_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}"

outline_environment_variable_utils_secret: "{{ '%s' | format(mash_playbook_generic_secret_key) | password_hash('sha512', 'utils.out', rounds=655555) | to_uuid }}"

outline_database_hostname: "{{ devture_postgres_identifier if devture_postgres_enabled else '' }}"
outline_database_port: "{{ '5432' if devture_postgres_enabled else '' }}"
outline_database_password: "{{ '%s' | format(mash_playbook_generic_secret_key) | password_hash('sha512', 'db.out', rounds=655555) | to_uuid }}"
outline_database_sslmode: "{{ 'disable' if devture_postgres_enabled and outline_database_hostname == devture_postgres_identifier else 'prefer' }}"

########################################################################
#                                                                      #
# /outline                                                             #
#                                                                      #
########################################################################
# /role-specific:outline



# role-specific:oauth2_proxy
########################################################################
#                                                                      #
# oauth2_proxy                                                         #
#                                                                      #
########################################################################

oauth2_proxy_enabled: false

oauth2_proxy_identifier: "{{ mash_playbook_service_identifier_prefix }}oauth2-proxy"

oauth2_proxy_uid: "{{ mash_playbook_uid }}"
oauth2_proxy_gid: "{{ mash_playbook_gid }}"

oauth2_proxy_base_path: "{{ mash_playbook_base_path }}/{{ mash_playbook_service_base_directory_name_prefix }}oauth2-proxy"

oauth2_proxy_container_network: "{{ (mash_playbook_reverse_proxyable_services_additional_network if mash_playbook_traefik_labels_enabled else '') | default(oauth2_proxy_identifier) }}"

oauth2_proxy_container_labels_traefik_enabled: "{{ mash_playbook_traefik_labels_enabled }}"
oauth2_proxy_container_labels_traefik_docker_network: "{{ mash_playbook_reverse_proxyable_services_additional_network }}"
oauth2_proxy_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
oauth2_proxy_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}"

########################################################################
#                                                                      #
# /oauth2_proxy                                                        #
#                                                                      #
########################################################################
# /role-specific:oauth2_proxy



# role-specific:owncast
########################################################################
#                                                                      #
# owncast                                                              #
#                                                                      #
########################################################################

owncast_enabled: false

owncast_identifier: "{{ mash_playbook_service_identifier_prefix }}owncast"

owncast_uid: "{{ mash_playbook_uid }}"
owncast_gid: "{{ mash_playbook_gid }}"

owncast_base_path: "{{ mash_playbook_base_path }}/{{ mash_playbook_service_base_directory_name_prefix }}owncast"

owncast_container_additional_networks: |
  {{
    ([mash_playbook_reverse_proxyable_services_additional_network] if mash_playbook_reverse_proxyable_services_additional_network else [])
  }}

owncast_container_labels_traefik_enabled: "{{ mash_playbook_traefik_labels_enabled }}"
owncast_container_labels_traefik_docker_network: "{{ mash_playbook_reverse_proxyable_services_additional_network }}"
owncast_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
owncast_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}"

########################################################################
#                                                                      #
# /owncast                                                             #
#                                                                      #
########################################################################
# /role-specific:owncast



# role-specific:oxitraffic
########################################################################
#                                                                      #
# oxitraffic                                                           #
#                                                                      #
########################################################################

oxitraffic_enabled: false

oxitraffic_identifier: "{{ mash_playbook_service_identifier_prefix }}oxitraffic"

oxitraffic_base_path: "{{ mash_playbook_base_path }}/{{ mash_playbook_service_base_directory_name_prefix }}oxitraffic"

oxitraffic_uid: "{{ mash_playbook_uid }}"
oxitraffic_gid: "{{ mash_playbook_gid }}"

oxitraffic_database_hostname: "{{ devture_postgres_identifier if devture_postgres_enabled else '' }}"
oxitraffic_database_port: "{{ '5432' if devture_postgres_enabled else '' }}"
oxitraffic_database_password: "{{ '%s' | format(mash_playbook_generic_secret_key) | password_hash('sha512', 'db.oxitraffic', rounds=655555) | to_uuid }}"

oxitraffic_systemd_required_services_list: |
  {{
    ([devture_systemd_docker_base_docker_service_name] if devture_systemd_docker_base_docker_service_name else [])
    +
    ([devture_postgres_identifier ~ '.service'] if devture_postgres_enabled and oxitraffic_database_hostname == devture_postgres_identifier else [])
  }}

oxitraffic_container_additional_networks: |
  {{
    ([mash_playbook_reverse_proxyable_services_additional_network] if mash_playbook_reverse_proxyable_services_additional_network else [])
    +
    ([devture_postgres_container_network] if devture_postgres_enabled and oxitraffic_database_hostname == devture_postgres_identifier and oxitraffic_container_network != devture_postgres_container_network else [])
  }}

oxitraffic_container_labels_traefik_enabled: "{{ mash_playbook_traefik_labels_enabled }}"
oxitraffic_container_labels_traefik_docker_network: "{{ mash_playbook_reverse_proxyable_services_additional_network }}"
oxitraffic_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
oxitraffic_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}"

########################################################################
#                                                                      #
# /oxitraffic                                                          #
#                                                                      #
########################################################################
# /role-specific:oxitraffic


# role-specific:paperless
########################################################################
#                                                                      #
# paperless                                                            #
#                                                                      #
########################################################################

paperless_enabled: false

paperless_identifier: "{{ mash_playbook_service_identifier_prefix }}paperless"

paperless_base_path: "{{ mash_playbook_base_path }}/{{ mash_playbook_service_base_directory_name_prefix }}paperless"

paperless_uid: "{{ mash_playbook_uid }}"
paperless_gid: "{{ mash_playbook_gid }}"

paperless_secret_key: "{{ '%s' | format(mash_playbook_generic_secret_key) | password_hash('sha512', 'paperless.secret', rounds=655555) | to_uuid }}"

paperless_database_hostname: "{{ devture_postgres_identifier if devture_postgres_enabled else '' }}"
paperless_database_username: "paperless"
paperless_database_port: "{{ '5432' if devture_postgres_enabled else '' }}"
paperless_database_password: "{{ '%s' | format(mash_playbook_generic_secret_key) | password_hash('sha512', 'db.paperless', rounds=655555) | to_uuid }}"

paperless_systemd_required_services_list: |
  {{
    ([devture_systemd_docker_base_docker_service_name] if devture_systemd_docker_base_docker_service_name else [])
    +
    ([devture_postgres_identifier ~ '.service'] if devture_postgres_enabled and paperless_database_hostname == devture_postgres_identifier else [])
  }}

paperless_container_additional_networks_auto: |
  {{
    ([mash_playbook_reverse_proxyable_services_additional_network] if mash_playbook_reverse_proxyable_services_additional_network else [])
    +
    ([devture_postgres_container_network] if devture_postgres_enabled and paperless_database_hostname == devture_postgres_identifier and paperless_container_network != devture_postgres_container_network else [])
    +
    ([exim_relay_container_network | default('mash-exim-relay')] if (exim_relay_enabled | default(false) and paperless_email_host == exim_relay_identifier | default('mash-exim-relay') and paperless_container_network != exim_relay_container_network) else [])
  }}

paperless_container_labels_traefik_enabled: "{{ mash_playbook_traefik_labels_enabled }}"
paperless_container_labels_traefik_docker_network: "{{ mash_playbook_reverse_proxyable_services_additional_network }}"
paperless_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
paperless_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}"

# role-specific:exim_relay
paperless_email_host: "{{ exim_relay_identifier if exim_relay_enabled else '' }}"
paperless_email_port: "{{ 8025 if exim_relay_enabled else '' }}"
paperless_email_from: "{{ exim_relay_sender_address if exim_relay_enabled else '' }}"
# /role-specific:exim_relay

########################################################################
#                                                                      #
# /paperless                                                           #
#                                                                      #
########################################################################
# /role-specific:paperless



# role-specific:peertube
########################################################################
#                                                                      #
# peertube                                                             #
#                                                                      #
########################################################################

peertube_enabled: false

peertube_identifier: "{{ mash_playbook_service_identifier_prefix }}peertube"

peertube_base_path: "{{ mash_playbook_base_path }}/{{ mash_playbook_service_base_directory_name_prefix }}peertube"

peertube_uid: "{{ mash_playbook_uid }}"
peertube_gid: "{{ mash_playbook_gid }}"

peertube_container_additional_networks_auto: |
  {{
    (
      ([mash_playbook_reverse_proxyable_services_additional_network] if mash_playbook_reverse_proxyable_services_additional_network else [])
      +
      ([devture_postgres_container_network] if devture_postgres_enabled and peertube_config_database_hostname == devture_postgres_identifier and peertube_container_network != devture_postgres_container_network else [])
      +
      ([exim_relay_container_network | default('mash-exim-relay')] if (exim_relay_enabled | default(false) and peertube_config_smtp_hostname == exim_relay_identifier | default('mash-exim-relay') and peertube_container_network != exim_relay_container_network) else [])
    ) | unique
  }}

peertube_container_labels_traefik_enabled: "{{ mash_playbook_traefik_labels_enabled }}"
peertube_container_labels_traefik_docker_network: "{{ mash_playbook_reverse_proxyable_services_additional_network }}"
peertube_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
peertube_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}"

peertube_config_database_hostname: "{{ devture_postgres_identifier if devture_postgres_enabled else '' }}"
peertube_config_database_port: "{{ '5432' if devture_postgres_enabled else '' }}"
peertube_config_database_username: peertube
peertube_config_database_password: "{{ '%s' | format(mash_playbook_generic_secret_key) | password_hash('sha512', 'db.peertube', rounds=655555) | to_uuid }}"

peertube_systemd_required_services_list_auto: |
  {{
    ([devture_postgres_identifier ~ '.service'] if devture_postgres_enabled and peertube_config_database_hostname == devture_postgres_identifier else [])
  }}

peertube_systemd_wanted_services_list_auto: |
  {{
    ([(exim_relay_identifier | default('mash-exim-relay')) ~ '.service'] if (exim_relay_enabled | default(false) and peertube_config_smtp_hostname == exim_relay_identifier | default('mash-exim-relay')) else [])
  }}

# role-specific:exim_relay
peertube_config_smtp_hostname: "{{ exim_relay_identifier if exim_relay_enabled else '' }}"
peertube_config_smtp_port: "{{ 8025 if exim_relay_enabled else '' }}"
peertube_config_smtp_from: "{{ exim_relay_sender_address if exim_relay_enabled else '' }}"
# /role-specific:exim_relay

########################################################################
#                                                                      #
# /peertube                                                            #
#                                                                      #
########################################################################
# /role-specific:peertube


# role-specific:plausible
########################################################################
#                                                                      #
# plausible                                                            #
#                                                                      #
########################################################################

plausible_enabled: false

plausible_identifier: "{{ mash_playbook_service_identifier_prefix }}plausible"

plausible_base_path: "{{ mash_playbook_base_path }}/{{ mash_playbook_service_base_directory_name_prefix }}plausible"

plausible_uid: "{{ mash_playbook_uid }}"
plausible_gid: "{{ mash_playbook_gid }}"

plausible_systemd_required_systemd_services_list_auto: |
  {{
    ([devture_postgres_identifier ~ '.service'] if devture_postgres_enabled and plausible_database_hostname == devture_postgres_identifier else [])
    +
    ([clickhouse_identifier ~ '.service'] if clickhouse_enabled | default(false) and plausible_clickhouse_database_hostname == clickhouse_identifier| default('mash-clickhouse') else [])
  }}

plausible_systemd_wanted_systemd_services_list_auto: |
  {{
    ([(exim_relay_identifier | default('mash-exim-relay')) ~ '.service'] if (exim_relay_enabled | default(false) and plausible_environment_variable_smtp_host_addr == exim_relay_identifier | default('mash-exim-relay')) else [])
  }}

plausible_container_additional_networks_auto: |
  {{
    ([mash_playbook_reverse_proxyable_services_additional_network] if mash_playbook_reverse_proxyable_services_additional_network else [])
    +
    ([devture_postgres_container_network] if devture_postgres_enabled and plausible_database_hostname == devture_postgres_identifier and plausible_container_network != devture_postgres_container_network else [])
    +
    ([clickhouse_container_network | default('mash-clickhouse')] if (clickhouse_enabled | default(false) and plausible_clickhouse_database_hostname == clickhouse_identifier | default('mash-clickhouse') and plausible_container_network != clickhouse_container_network | default('mash-clickhouse')) else [])
    +
    ([exim_relay_container_network | default('mash-exim-relay')] if (exim_relay_enabled | default(false) and plausible_environment_variable_smtp_host_addr == exim_relay_identifier | default('mash-exim-relay') and plausible_container_network != exim_relay_container_network) else [])
  }}

plausible_container_labels_traefik_enabled: "{{ mash_playbook_traefik_labels_enabled }}"
plausible_container_labels_traefik_docker_network: "{{ mash_playbook_reverse_proxyable_services_additional_network }}"
plausible_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
plausible_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}"

plausible_database_hostname: "{{ devture_postgres_connection_hostname if devture_postgres_enabled else '' }}"
plausible_database_password: "{{ ('%s' | format(mash_playbook_generic_secret_key) | password_hash('sha512', 'plausible.db', rounds=655555) | to_uuid) if devture_postgres_enabled else '' }}"

# role-specific:clickhouse
plausible_clickhouse_database_hostname: "{{ clickhouse_identifier if clickhouse_enabled else '' }}"
plausible_clickhouse_database_password: "{{ ('%s' | format(mash_playbook_generic_secret_key) | password_hash('sha512', 'plaus.clk.db', rounds=655555) | to_uuid) if clickhouse_enabled else '' }}"
# /role-specific:clickhouse

# role-specific:exim_relay
# As of 2024-06-28, only `Bamboo.SMTPAdapter` behaves well when no SMTP username/password AUTH is required (as is the case for exim-relay).
# The Bamboo.Mua SMTP adapter is more modern, but always sends authentication, even when the SMTP user is empty.
plausible_environment_variable_mailer_adapter: "{{ 'Bamboo.SMTPAdapter' if exim_relay_enabled else 'Bamboo.LocalAdapter' }}"
plausible_environment_variable_mailer_email: "{{ exim_relay_sender_address if exim_relay_enabled else '' }}"
plausible_environment_variable_smtp_host_addr: "{{ exim_relay_identifier if exim_relay_enabled else '' }}"
plausible_environment_variable_smtp_host_port: "{{ 8025 if exim_relay_enabled else '587' }}"
plausible_environment_variable_smtp_host_ssl_enabled: false
# /role-specific:exim_relay

########################################################################
#                                                                      #
# /plausible                                                           #
#                                                                      #
########################################################################
# /role-specific:plausible



# role-specific:postgis
########################################################################
#                                                                      #
# postgis                                                              #
#                                                                      #
########################################################################

postgis_enabled: false

postgis_identifier: "{{ mash_playbook_service_identifier_prefix }}postgis"

postgis_architecture: "{{ mash_playbook_architecture }}"

postgis_base_path: "{{ mash_playbook_base_path }}/{{ mash_playbook_service_base_directory_name_prefix }}postgis"

postgis_uid: "{{ mash_playbook_uid }}"
postgis_gid: "{{ mash_playbook_gid }}"

postgis_systemd_services_to_stop_for_maintenance_list: |
  {{
    ([(mobilizon_identifier + '.service')] if mobilizon_enabled else [])
  }}

postgis_managed_databases_auto: |
  {{
    ([{
      'name': mobilizon_database_name,
      'username': mobilizon_database_username,
      'password': mobilizon_database_password,
    }] if mobilizon_enabled and mobilizon_database_type == 'postgis' and mobilizon_database_hostname == postgis_identifier else [])
  }}

########################################################################
#                                                                      #
# /postgis                                                             #
#                                                                      #
########################################################################
# /role-specific:postgis




# role-specific:prometheus_postgres_exporter
########################################################################
#                                                                      #
# prometheus_postgres_exporter                                         #
#                                                                      #
########################################################################

prometheus_postgres_exporter_enabled: false

prometheus_postgres_exporter_identifier: "{{ mash_playbook_service_identifier_prefix }}prometheus-postgres-exporter"

prometheus_postgres_exporter_hostname: "{{ mash_playbook_metrics_exposure_hostname }}"
prometheus_postgres_exporter_path_prefix: "{{ mash_playbook_metrics_exposure_path_prefix }}/{{ prometheus_postgres_exporter_identifier }}"

prometheus_postgres_exporter_base_path: "{{ mash_playbook_base_path }}/{{ mash_playbook_service_base_directory_name_prefix }}prometheus-postgres-exporter"

prometheus_postgres_exporter_uid: "{{ mash_playbook_uid }}"
prometheus_postgres_exporter_gid: "{{ mash_playbook_gid }}"

prometheus_postgres_exporter_container_additional_networks: |
  {{
    ([mash_playbook_reverse_proxyable_services_additional_network] if mash_playbook_reverse_proxyable_services_additional_network else [])
    +
    ([devture_postgres_container_network] if devture_postgres_enabled and prometheus_postgres_exporter_database_hostname == devture_postgres_identifier and prometheus_postgres_exporter_container_network != devture_postgres_container_network else [])
  }}

# Only enable Traefik labels if a hostname is set (indicating that this will be exposed publicly)
prometheus_postgres_exporter_container_labels_traefik_enabled: "{{ mash_playbook_traefik_labels_enabled and prometheus_postgres_exporter_hostname | length > 0 }}"
prometheus_postgres_exporter_container_labels_traefik_docker_network: "{{ mash_playbook_reverse_proxyable_services_additional_network }}"
prometheus_postgres_exporter_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
prometheus_postgres_exporter_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}"

prometheus_postgres_exporter_container_labels_metrics_middleware_basic_auth_enabled: "{{ mash_playbook_metrics_exposure_http_basic_auth_enabled }}"
prometheus_postgres_exporter_container_labels_metrics_middleware_basic_auth_users: "{{ mash_playbook_metrics_exposure_http_basic_auth_users }}"

prometheus_postgres_exporter_database_hostname: "{{ devture_postgres_connection_hostname if devture_postgres_enabled else '' }}"
prometheus_postgres_exporter_database_username: prometheus_postgres_exporter
prometheus_postgres_exporter_database_password: "{{ devture_postgres_connection_password if devture_postgres_enabled else '' }}"
prometheus_postgres_exporter_database_port: "{{ devture_postgres_connection_port if devture_postgres_enabled else 5432 }}"
prometheus_postgres_exporter_database_ssl: false

prometheus_postgres_exporter_systemd_required_services_list: |
  {{
    ([devture_systemd_docker_base_docker_service_name] if devture_systemd_docker_base_docker_service_name else [])
    +
    ([devture_postgres_identifier ~ '.service'] if devture_postgres_enabled else [])
  }}

########################################################################
#                                                                      #
# /prometheus_postgres_exporter                                        #
#                                                                      #
########################################################################
# /role-specific:prometheus_postgres_exporter



# role-specific:prometheus
########################################################################
#                                                                      #
# prometheus                                                           #
#                                                                      #
########################################################################

prometheus_enabled: false

prometheus_identifier: "{{ mash_playbook_service_identifier_prefix }}prometheus"

prometheus_base_path: "{{ mash_playbook_base_path }}/{{ mash_playbook_service_base_directory_name_prefix }}prometheus"

prometheus_uid: "{{ mash_playbook_uid }}"
prometheus_gid: "{{ mash_playbook_gid }}"

# Only enable Traefik labels if a hostname is set (indicating that this will be exposed publicly)
prometheus_container_labels_traefik_enabled: "{{ mash_playbook_traefik_labels_enabled and prometheus_hostname | length > 0 }}"
prometheus_container_labels_traefik_docker_network: "{{ mash_playbook_reverse_proxyable_services_additional_network }}"
prometheus_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
prometheus_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}"

prometheus_container_additional_networks_auto: |
  {{
    ([mash_playbook_reverse_proxyable_services_additional_network] if mash_playbook_reverse_proxyable_services_additional_network else [])
  }}


########################################################################
#                                                                      #
# /prometheus                                                          #
#                                                                      #
########################################################################
# /role-specific:prometheus



# role-specific:prometheus_blackbox_exporter
########################################################################
#                                                                      #
# prometheus_blackbox_exporter                                         #
#                                                                      #
########################################################################

prometheus_blackbox_exporter_enabled: false

prometheus_blackbox_exporter_identifier: "{{ mash_playbook_service_identifier_prefix }}prometheus-blackbox-exporter"

prometheus_blackbox_exporter_hostname: "{{ mash_playbook_metrics_exposure_hostname }}"
prometheus_blackbox_exporter_path_prefix: "{{ mash_playbook_metrics_exposure_path_prefix }}/{{ prometheus_blackbox_exporter_identifier }}"

prometheus_blackbox_exporter_base_path: "{{ mash_playbook_base_path }}/{{ mash_playbook_service_base_directory_name_prefix }}prometheus-blackbox-exporter"

prometheus_blackbox_exporter_uid: "{{ mash_playbook_uid }}"
prometheus_blackbox_exporter_gid: "{{ mash_playbook_gid }}"

prometheus_blackbox_exporter_container_additional_networks: |
  {{
    ([mash_playbook_reverse_proxyable_services_additional_network] if mash_playbook_reverse_proxyable_services_additional_network else [])
  }}

# Only enable Traefik labels if a hostname is set (indicating that this will be exposed publicly)
prometheus_blackbox_exporter_container_labels_traefik_enabled: "{{ mash_playbook_traefik_labels_enabled and prometheus_blackbox_exporter_hostname }}"
prometheus_blackbox_exporter_container_labels_traefik_docker_network: "{{ mash_playbook_reverse_proxyable_services_additional_network }}"
prometheus_blackbox_exporter_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
prometheus_blackbox_exporter_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}"

prometheus_blackbox_exporter_container_labels_metrics_middleware_basic_auth_enabled: "{{ mash_playbook_metrics_exposure_http_basic_auth_enabled }}"
prometheus_blackbox_exporter_container_labels_metrics_middleware_basic_auth_users: "{{ mash_playbook_metrics_exposure_http_basic_auth_users }}"

########################################################################
#                                                                      #
# /prometheus_blackbox_exporter                                        #
#                                                                      #
########################################################################
# /role-specific:prometheus_blackbox_exporter



# role-specific:prometheus_ssh_exporter
########################################################################
#                                                                      #
# prometheus_ssh_exporter                                              #
#                                                                      #
########################################################################

prometheus_ssh_exporter_enabled: false

prometheus_ssh_exporter_identifier: "{{ mash_playbook_service_identifier_prefix }}prometheus-ssh-exporter"

prometheus_ssh_exporter_hostname: "{{ mash_playbook_metrics_exposure_hostname }}"
prometheus_ssh_exporter_path_prefix: "{{ mash_playbook_metrics_exposure_path_prefix }}/{{ prometheus_ssh_exporter_identifier }}"

prometheus_ssh_exporter_base_path: "{{ mash_playbook_base_path }}/{{ mash_playbook_service_base_directory_name_prefix }}prometheus-ssh-exporter"

prometheus_ssh_exporter_uid: "{{ mash_playbook_uid }}"
prometheus_ssh_exporter_gid: "{{ mash_playbook_gid }}"

prometheus_ssh_exporter_container_additional_networks: |
  {{
    ([mash_playbook_reverse_proxyable_services_additional_network] if mash_playbook_reverse_proxyable_services_additional_network else [])
  }}

# Only enable Traefik labels if a hostname is set (indicating that this will be exposed publicly)
prometheus_ssh_exporter_container_labels_traefik_enabled: "{{ mash_playbook_traefik_labels_enabled and prometheus_ssh_exporter_hostname }}"
prometheus_ssh_exporter_container_labels_traefik_docker_network: "{{ mash_playbook_reverse_proxyable_services_additional_network }}"
prometheus_ssh_exporter_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
prometheus_ssh_exporter_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}"

prometheus_ssh_exporter_container_labels_metrics_middleware_basic_auth_enabled: "{{ mash_playbook_metrics_exposure_http_basic_auth_enabled }}"
prometheus_ssh_exporter_container_labels_metrics_middleware_basic_auth_users: "{{ mash_playbook_metrics_exposure_http_basic_auth_users }}"

########################################################################
#                                                                      #
# /prometheus_ssh_exporter                                             #
#                                                                      #
########################################################################
# /role-specific:prometheus_ssh_exporter



# role-specific:prometheus_node_exporter
########################################################################
#                                                                      #
# prometheus_node_exporter                                             #
#                                                                      #
########################################################################

prometheus_node_exporter_enabled: false

prometheus_node_exporter_identifier: "{{ mash_playbook_service_identifier_prefix }}prometheus-node-exporter"

prometheus_node_exporter_hostname: "{{ mash_playbook_metrics_exposure_hostname }}"
prometheus_node_exporter_path_prefix: "{{ mash_playbook_metrics_exposure_path_prefix }}/{{ prometheus_node_exporter_identifier }}"

prometheus_node_exporter_base_path: "{{ mash_playbook_base_path }}/{{ mash_playbook_service_base_directory_name_prefix }}prometheus-node-exporter"

prometheus_node_exporter_uid: "{{ mash_playbook_uid }}"
prometheus_node_exporter_gid: "{{ mash_playbook_gid }}"

prometheus_node_exporter_container_additional_networks: |
  {{
    ([mash_playbook_reverse_proxyable_services_additional_network] if mash_playbook_reverse_proxyable_services_additional_network else [])
  }}

# Only enable Traefik labels if a hostname is set (indicating that this will be exposed publicly)
prometheus_node_exporter_container_labels_traefik_enabled: "{{ mash_playbook_traefik_labels_enabled and prometheus_node_exporter_hostname }}"
prometheus_node_exporter_container_labels_traefik_docker_network: "{{ mash_playbook_reverse_proxyable_services_additional_network }}"
prometheus_node_exporter_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
prometheus_node_exporter_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}"

prometheus_node_exporter_container_labels_metrics_middleware_basic_auth_enabled: "{{ mash_playbook_metrics_exposure_http_basic_auth_enabled }}"
prometheus_node_exporter_container_labels_metrics_middleware_basic_auth_users: "{{ mash_playbook_metrics_exposure_http_basic_auth_users }}"

prometheus_node_exporter_process_extra_arguments:
  - "--collector.disable-defaults"
  - "--collector.cpu"
  - "--collector.filesystem"
  - "--collector.meminfo"
  - "--collector.systemd"
  - "--collector.uname"

prometheus_node_exporter_container_extra_arguments:
  - "--security-opt apparmor=unconfined"
  - "--mount type=bind,src=/var/run/dbus/system_bus_socket,dst=/var/run/dbus/system_bus_socket,ro,bind-propagation=rslave"

########################################################################
#                                                                      #
# /prometheus_node_exporter                                            #
#                                                                      #
########################################################################
# /role-specific:prometheus_node_exporter



# role-specific:promtail
########################################################################
#                                                                      #
# promtail                                                             #
#                                                                      #
########################################################################

promtail_enabled: false

promtail_identifier: "{{ mash_playbook_service_identifier_prefix }}promtail"

promtail_base_path: "{{ mash_playbook_base_path }}/{{ mash_playbook_service_base_directory_name_prefix }}promtail"

promtail_uid: "{{ mash_playbook_uid }}"
promtail_gid: "{{ mash_playbook_gid }}"

# role-specific:loki
promtail_config_clients_auto: |
  {{
    ([{
      'url': ('http://' + loki_identifier + ':' + (loki_server_http_listen_port | string) + '/loki/api/v1/push'),
      'tenant_id': 'mash',
    }] if loki_enabled else [])
  }}
# /role-specific:loki

# Only enable Traefik labels if a hostname is set (indicating that this will be exposed publicly)
promtail_container_labels_traefik_enabled: "{{ mash_playbook_traefik_labels_enabled }}"
promtail_container_labels_traefik_docker_network: "{{ mash_playbook_reverse_proxyable_services_additional_network }}"
promtail_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
promtail_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}"

promtail_container_labels_metrics_enabled: "{{ prometheus_enabled | default(false) or mash_playbook_metrics_exposure_enabled }}"
promtail_container_labels_metrics_hostname: "{{ mash_playbook_metrics_exposure_hostname }}"
promtail_container_labels_metrics_path_prefix: "{{ mash_playbook_metrics_exposure_path_prefix }}/{{ promtail_identifier }}"
promtail_container_labels_metrics_traefik_middleware_basic_auth_enabled: "{{ mash_playbook_metrics_exposure_http_basic_auth_enabled }}"
promtail_container_labels_metrics_traefik_middleware_basic_auth_users: "{{ mash_playbook_metrics_exposure_http_basic_auth_users }}"

promtail_container_additional_networks_auto: |
  {{
    (
      ([mash_playbook_reverse_proxyable_services_additional_network] if mash_playbook_reverse_proxyable_services_additional_network else [])
      +
      ([loki_container_network] if (loki_enabled | default(false) and loki_container_network | default('') != promtail_container_network) else [])
    ) | unique
  }}

########################################################################
#                                                                      #
# /promtail                                                            #
#                                                                      #
########################################################################
# /role-specific:promtail


# role-specific:radicale
########################################################################
#                                                                      #
# radicale                                                             #
#                                                                      #
########################################################################

radicale_enabled: false

radicale_identifier: "{{ mash_playbook_service_identifier_prefix }}radicale"

radicale_base_path: "{{ mash_playbook_base_path }}/{{ mash_playbook_service_base_directory_name_prefix }}radicale"

radicale_uid: "{{ mash_playbook_uid }}"
radicale_gid: "{{ mash_playbook_gid }}"

radicale_container_additional_networks: |
  {{
    ([mash_playbook_reverse_proxyable_services_additional_network] if mash_playbook_reverse_proxyable_services_additional_network else [])
  }}

radicale_container_labels_traefik_enabled: "{{ mash_playbook_traefik_labels_enabled }}"
radicale_container_labels_traefik_docker_network: "{{ mash_playbook_reverse_proxyable_services_additional_network }}"
radicale_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
radicale_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}"

########################################################################
#                                                                      #
# /radicale                                                            #
#                                                                      #
########################################################################
# /role-specific:radicale



# role-specific:redmine
########################################################################
#                                                                      #
# redmine                                                              #
#                                                                      #
########################################################################

redmine_enabled: false

redmine_identifier: "{{ mash_playbook_service_identifier_prefix }}redmine"

redmine_base_path: "{{ mash_playbook_base_path }}/{{ mash_playbook_service_base_directory_name_prefix }}redmine"

redmine_uid: "{{ mash_playbook_uid }}"
redmine_gid: "{{ mash_playbook_gid }}"

redmine_secret_key_base: "{{ '%s' | format(mash_playbook_generic_secret_key) | password_hash('sha512', 'secret.base', rounds=655555) | to_uuid }}"
redmine_secret_token: "{{ '%s' | format(mash_playbook_generic_secret_key) | password_hash('sha512', 'secret.token', rounds=655555) | to_uuid }}"
redmine_database_cipher_key: "{{ '%s' | format(mash_playbook_generic_secret_key) | password_hash('sha512', 'db.cipherkey', rounds=655555) | to_uuid }}"

redmine_systemd_required_services_list: |
  {{
    ([devture_systemd_docker_base_docker_service_name] if devture_systemd_docker_base_docker_service_name else [])
    +
    ([devture_postgres_identifier ~ '.service'] if devture_postgres_enabled and redmine_database_hostname == devture_postgres_identifier else [])
  }}

redmine_container_additional_networks: |
  {{
    ([mash_playbook_reverse_proxyable_services_additional_network] if mash_playbook_reverse_proxyable_services_additional_network else [])
    +
    ([devture_postgres_container_network] if devture_postgres_enabled and redmine_database_hostname == devture_postgres_identifier and redmine_container_network != devture_postgres_container_network else [])
  }}

redmine_container_labels_traefik_enabled: "{{ mash_playbook_traefik_labels_enabled }}"
redmine_container_labels_traefik_docker_network: "{{ mash_playbook_reverse_proxyable_services_additional_network }}"
redmine_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
redmine_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}"

redmine_database_type: "{{ 'postgresql' if devture_postgres_enabled else 'sqlite3' }}"
redmine_database_hostname: "{{ devture_postgres_connection_hostname if devture_postgres_enabled else '' }}"
redmine_database_username: "redmine"
redmine_database_password: "{{ '%s' | format(mash_playbook_generic_secret_key) | password_hash('sha512', 'redmine.db', rounds=655555) | to_uuid }}"

########################################################################
#                                                                      #
# /redmine                                                             #
#                                                                      #
########################################################################
# /role-specific:redmine



# role-specific:redis
########################################################################
#                                                                      #
# redis                                                                #
#                                                                      #
########################################################################

redis_enabled: false

redis_identifier: "{{ mash_playbook_service_identifier_prefix }}redis"

redis_base_path: "{{ mash_playbook_base_path }}/{{ mash_playbook_service_base_directory_name_prefix }}redis"

redis_uid: "{{ mash_playbook_uid }}"
redis_gid: "{{ mash_playbook_gid }}"

########################################################################
#                                                                      #
# /redis                                                               #
#                                                                      #
########################################################################
# /role-specific:redis


# role-specific:keydb
########################################################################
#                                                                      #
# keydb                                                                #
#                                                                      #
########################################################################

keydb_enabled: false

keydb_identifier: "{{ mash_playbook_service_identifier_prefix }}keydb"

keydb_uid: "{{ mash_playbook_uid }}"
keydb_gid: "{{ mash_playbook_gid }}"

keydb_base_path: "{{ mash_playbook_base_path }}/{{ mash_playbook_service_base_directory_name_prefix }}keydb"

keydb_arch: |-
  {{
    ({
      'amd64': 'x86_64',
      'arm32': 'arm32',
      'arm64': 'arm64',
    })[mash_playbook_architecture]
  }}

########################################################################
#                                                                      #
# /keydb                                                               #
#                                                                      #
########################################################################
# /role-specific:keydb


# role-specific:roundcube
########################################################################
#                                                                      #
# roundcube                                                            #
#                                                                      #
########################################################################

roundcube_enabled: false

roundcube_identifier: "{{ mash_playbook_service_identifier_prefix }}roundcube"

roundcube_base_path: "{{ mash_playbook_base_path }}/{{ mash_playbook_service_base_directory_name_prefix }}roundcube"

roundcube_uid: "0"
roundcube_gid: "0"

roundcube_database_type: "{{ 'postgresql' if devture_postgres_enabled else 'sqlite' }}"
roundcube_database_hostname: "{{ devture_postgres_identifier if devture_postgres_enabled else '' }}"
roundcube_database_port: "{{ '5432' if devture_postgres_enabled else '' }}"
roundcube_database_name: "{{ 'roundcube' if devture_postgres_enabled else '' }}"
roundcube_database_username: "{{ 'roundcube' if devture_postgres_enabled else '' }}"
roundcube_database_password: "{{ '%s' | format(mash_playbook_generic_secret_key) | password_hash('sha512', 'db.roundcube', rounds=655555) | to_uuid }}"

roundcube_systemd_required_systemd_services_list: |
  {{
    ([devture_systemd_docker_base_docker_service_name] if devture_systemd_docker_base_docker_service_name else [])
    +
    ([devture_postgres_identifier ~ '.service'] if devture_postgres_enabled and roundcube_database_hostname == devture_postgres_identifier else [])
  }}

roundcube_container_labels_traefik_enabled: "{{ mash_playbook_traefik_labels_enabled }}"
roundcube_container_labels_traefik_docker_network: "{{ mash_playbook_reverse_proxyable_services_additional_network }}"
roundcube_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
roundcube_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}"

roundcube_container_additional_networks: |
  {{
    ([mash_playbook_reverse_proxyable_services_additional_network] if mash_playbook_reverse_proxyable_services_additional_network else [])
    +
    ([devture_postgres_container_network] if devture_postgres_enabled and roundcube_database_hostname == devture_postgres_identifier and roundcube_container_network != devture_postgres_container_network else [])
  }}

########################################################################
#                                                                      #
# /roundcube                                                           #
#                                                                      #
########################################################################
# /role-specific:roundcube



# role-specific:rumqttd
########################################################################
#                                                                      #
# rumqttd                                                              #
#                                                                      #
########################################################################

rumqttd_enabled: false

rumqttd_identifier: "{{ mash_playbook_service_identifier_prefix }}rumqttd"

rumqttd_base_path: "{{ mash_playbook_base_path }}/{{ mash_playbook_service_base_directory_name_prefix }}rumqttd"

rumqttd_uid: "{{ mash_playbook_uid }}"
rumqttd_gid: "{{ mash_playbook_gid }}"

########################################################################
#                                                                      #
# /rumqttd                                                             #
#                                                                      #
########################################################################
# /role-specific:rumqttd



# role-specific:semaphore
########################################################################
#                                                                      #
# semaphore                                                            #
#                                                                      #
########################################################################

semaphore_enabled: false

semaphore_identifier: "{{ mash_playbook_service_identifier_prefix }}semaphore"

semaphore_base_path: "{{ mash_playbook_base_path }}/{{ mash_playbook_service_base_directory_name_prefix }}semaphore"

semaphore_uid: "{{ mash_playbook_uid }}"
semaphore_gid: "{{ mash_playbook_gid }}"

semaphore_database_host: "{{ devture_postgres_identifier if devture_postgres_enabled else '' }}"
semaphore_database_port: "{{ '5432' if devture_postgres_enabled else '' }}"
semaphore_database_password: "{{ '%s' | format(mash_playbook_generic_secret_key) | password_hash('sha512', 'db.semaphore', rounds=655555) | to_uuid }}"
semaphore_database_username: "{{ semaphore_identifier }}"

semaphore_systemd_required_services_list: |
  {{
    ([devture_systemd_docker_base_docker_service_name] if devture_systemd_docker_base_docker_service_name else [])
    +
    ([devture_postgres_identifier ~ '.service'] if devture_postgres_enabled and semaphore_database_host == devture_postgres_identifier else [])
  }}

semaphore_container_additional_networks: |
  {{
    ([mash_playbook_reverse_proxyable_services_additional_network] if mash_playbook_reverse_proxyable_services_additional_network else [])
    +
    ([devture_postgres_container_network] if devture_postgres_enabled and semaphore_database_host == devture_postgres_identifier and semaphore_container_network != devture_postgres_container_network else [])
  }}

semaphore_container_labels_traefik_enabled: "{{ mash_playbook_traefik_labels_enabled }}"
semaphore_container_labels_traefik_docker_network: "{{ mash_playbook_reverse_proxyable_services_additional_network }}"
semaphore_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
semaphore_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}"

########################################################################
#                                                                      #
# /semaphore                                                           #
#                                                                      #
########################################################################
# /role-specific:semaphore



# role-specific:soft_serve
########################################################################
#                                                                      #
# soft-serve                                                           #
#                                                                      #
########################################################################

soft_serve_enabled: false

soft_serve_identifier: "{{ mash_playbook_service_identifier_prefix }}soft-serve"

soft_serve_uid: "{{ mash_playbook_uid }}"
soft_serve_gid: "{{ mash_playbook_gid }}"

soft_serve_base_path: "{{ mash_playbook_base_path }}/{{ mash_playbook_service_base_directory_name_prefix }}soft-serve"

########################################################################
#                                                                      #
# /soft-serve                                                          #
#                                                                      #
########################################################################
# /role-specific:soft_serve



# role-specific:stirling_pdf
########################################################################
#                                                                      #
# stirling-pdf                                                         #
#                                                                      #
########################################################################

stirling_pdf_enabled: false

stirling_pdf_identifier: "{{ mash_playbook_service_identifier_prefix }}stirling-pdf"

stirling_pdf_uid: "{{ mash_playbook_uid }}"
stirling_pdf_gid: "{{ mash_playbook_gid }}"

stirling_pdf_base_path: "{{ mash_playbook_base_path }}/{{ mash_playbook_service_base_directory_name_prefix }}stirling-pdf"

stirling_pdf_container_additional_networks_auto: |
  {{
    ([mash_playbook_reverse_proxyable_services_additional_network] if mash_playbook_reverse_proxyable_services_additional_network else [])
  }}

stirling_pdf_container_labels_traefik_enabled: "{{ mash_playbook_traefik_labels_enabled }}"
stirling_pdf_container_labels_traefik_docker_network: "{{ mash_playbook_reverse_proxyable_services_additional_network }}"
stirling_pdf_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
stirling_pdf_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}"

########################################################################
#                                                                      #
# /stirling-pdf                                                        #
#                                                                      #
########################################################################
# /role-specific:stirling_pdf



# role-specific:syncthing
########################################################################
#                                                                      #
# syncthing                                                            #
#                                                                      #
########################################################################

syncthing_enabled: false

syncthing_identifier: "{{ mash_playbook_service_identifier_prefix }}syncthing"

syncthing_uid: "{{ mash_playbook_uid }}"
syncthing_gid: "{{ mash_playbook_gid }}"

syncthing_base_path: "{{ mash_playbook_base_path }}/{{ mash_playbook_service_base_directory_name_prefix }}syncthing"

syncthing_container_additional_networks_auto: |
  {{
    ([mash_playbook_reverse_proxyable_services_additional_network] if mash_playbook_reverse_proxyable_services_additional_network else [])
  }}

syncthing_container_labels_traefik_enabled: "{{ mash_playbook_traefik_labels_enabled }}"
syncthing_container_labels_traefik_docker_network: "{{ mash_playbook_reverse_proxyable_services_additional_network }}"
syncthing_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
syncthing_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}"

########################################################################
#                                                                      #
# /syncthing                                                           #
#                                                                      #
########################################################################
# /role-specific:syncthing




########################################################################
#                                                                      #
# tandoor                                                              #
#                                                                      #
########################################################################

tandoor_enabled: false

tandoor_identifier: "{{ mash_playbook_service_identifier_prefix }}tandoor"

tandoor_base_path: "{{ mash_playbook_base_path }}/{{ mash_playbook_service_base_directory_name_prefix }}tandoor"

tandoor_uid: "{{ mash_playbook_uid }}"
tandoor_gid: "{{ mash_playbook_gid }}"

tandoor_systemd_required_services_list_auto: |
  {{
    ([devture_postgres_identifier ~ '.service'] if devture_postgres_enabled and tandoor_database_hostname == devture_postgres_identifier else [])
  }}

tandoor_systemd_wanted_services_list_auto: |
  {{
    ([(exim_relay_identifier | default('mash-exim-relay')) ~ '.service'] if (exim_relay_enabled | default(false) and tandoor_email_host == exim_relay_identifier | default('mash-exim-relay')) else [])
  }}

tandoor_api_container_additional_networks_auto: |
  {{
    (
      ([devture_postgres_container_network] if devture_postgres_enabled and tandoor_database_hostname == devture_postgres_identifier and tandoor_container_network != devture_postgres_container_network else [])
      +
      ([exim_relay_container_network | default('mash-exim-relay')] if (exim_relay_enabled | default(false) and tandoor_email_host == exim_relay_identifier | default('mash-exim-relay') and tandoor_container_network != exim_relay_container_network) else [])
    ) | unique
  }}

tandoor_frontend_container_additional_networks_auto: |
  {{
    ([mash_playbook_reverse_proxyable_services_additional_network] if mash_playbook_reverse_proxyable_services_additional_network else [])
  }}

tandoor_frontend_container_labels_traefik_enabled: "{{ mash_playbook_traefik_labels_enabled }}"
tandoor_frontend_container_labels_traefik_docker_network: "{{ mash_playbook_reverse_proxyable_services_additional_network }}"
tandoor_frontend_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
tandoor_frontend_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}"

tandoor_database_hostname: "{{ devture_postgres_identifier if devture_postgres_enabled else '' }}"
tandoor_database_port: "{{ '5432' if devture_postgres_enabled else '' }}"
tandoor_database_username: "tandoor"
tandoor_database_password: "{{ '%s' | format(mash_playbook_generic_secret_key) | password_hash('sha512', 'db.tandoor', rounds=655555) | to_uuid }}"

tandoor_environment_variable_secret: "{{ '%s' | format(mash_playbook_generic_secret_key) | password_hash('sha512', 'secret.tandoor', rounds=655555) | to_uuid }}"

# role-specific:exim_relay
tandoor_email_host: "{{ exim_relay_identifier if exim_relay_enabled else '' }}"
tandoor_email_port: "{{ 8025 if exim_relay_enabled else '' }}"
tandoor_default_from_email: "{{ exim_relay_sender_address if exim_relay_enabled else '' }}"
# /role-specific:exim_relay

########################################################################
#                                                                      #
# /tandoor                                                             #
#                                                                      #
########################################################################




# role-specific:telegraf
########################################################################
#                                                                      #
# telegraf                                                             #
#                                                                      #
########################################################################

telegraf_enabled: false

telegraf_identifier: "{{ mash_playbook_service_identifier_prefix }}telegraf"

telegraf_base_path: "{{ mash_playbook_base_path }}/{{ mash_playbook_service_base_directory_name_prefix }}telegraf"

telegraf_uid: "{{ mash_playbook_uid }}"
telegraf_gid: "{{ mash_playbook_gid }}"

telegraf_systemd_required_services_list: |
  {{
    ([devture_systemd_docker_base_docker_service_name] if devture_systemd_docker_base_docker_service_name else [])
    +
    ([(influxdb_identifier + '.service')] if influxdb_enabled else [])
  }}


########################################################################
#                                                                      #
# /telegraf                                                            #
#                                                                      #
########################################################################
# /role-specific:telegraf



# role-specific:vaultwarden
########################################################################
#                                                                      #
# vaultwarden                                                          #
#                                                                      #
########################################################################

vaultwarden_enabled: false

vaultwarden_identifier: "{{ mash_playbook_service_identifier_prefix }}vaultwarden"

vaultwarden_uid: "{{ mash_playbook_uid }}"
vaultwarden_gid: "{{ mash_playbook_gid }}"

vaultwarden_base_path: "{{ mash_playbook_base_path }}/{{ mash_playbook_service_base_directory_name_prefix }}vaultwarden"

vaultwarden_systemd_required_systemd_services_list_auto: |
  {{
    ([devture_postgres_identifier ~ '.service'] if devture_postgres_enabled and vaultwarden_database_hostname == devture_postgres_identifier else [])
  }}

vaultwarden_systemd_wanted_systemd_services_list_auto: |
  {{
    ([(exim_relay_identifier | default('mash-exim-relay')) ~ '.service'] if (exim_relay_enabled | default(false) and vaultwarden_config_smtp_host == exim_relay_identifier | default('mash-exim-relay')) else [])
  }}

vaultwarden_container_additional_networks_auto: |
  {{
    ([mash_playbook_reverse_proxyable_services_additional_network] if mash_playbook_reverse_proxyable_services_additional_network else [])
    +
    ([devture_postgres_container_network] if devture_postgres_enabled and vaultwarden_database_hostname == devture_postgres_identifier and vaultwarden_container_network != devture_postgres_container_network else [])
    +
    ([exim_relay_container_network | default('mash-exim-relay')] if (exim_relay_enabled | default(false) and vaultwarden_config_smtp_host == exim_relay_identifier | default('mash-exim-relay') and vaultwarden_container_network != exim_relay_container_network) else [])
  }}

vaultwarden_container_labels_traefik_enabled: "{{ mash_playbook_traefik_labels_enabled }}"
vaultwarden_container_labels_traefik_docker_network: "{{ mash_playbook_reverse_proxyable_services_additional_network }}"
vaultwarden_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
vaultwarden_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}"

vaultwarden_database_hostname: "{{ devture_postgres_identifier if devture_postgres_enabled else '' }}"
vaultwarden_database_port: "{{ '5432' if devture_postgres_enabled else '' }}"
vaultwarden_database_username: "vaultwarden"
vaultwarden_database_password: "{{ '%s' | format(mash_playbook_generic_secret_key) | password_hash('sha512', 'db.vaultwarden', rounds=655555) | to_uuid }}"

# role-specific:exim_relay
vaultwarden_config_smtp_from: "{{ exim_relay_sender_address if exim_relay_enabled else '' }}"
vaultwarden_config_smtp_host: "{{ exim_relay_identifier if exim_relay_enabled else '' }}"
vaultwarden_config_smtp_port: "{{ 8025 if exim_relay_enabled else '587' }}"
vaultwarden_config_smtp_security: "{{ 'off' if exim_relay_enabled else 'starttls' }}"
# /role-specific:exim_relay

########################################################################
#                                                                      #
# /vaultwarden                                                         #
#                                                                      #
########################################################################
# /role-specific:vaultwarden



# role-specific:uptime_kuma
########################################################################
#                                                                      #
# uptime_kuma                                                          #
#                                                                      #
########################################################################

uptime_kuma_enabled: false

uptime_kuma_identifier: "{{ mash_playbook_service_identifier_prefix }}uptime-kuma"

uptime_kuma_base_path: "{{ mash_playbook_base_path }}/{{ mash_playbook_service_base_directory_name_prefix }}uptime-kuma"

uptime_kuma_uid: "{{ mash_playbook_uid }}"
uptime_kuma_gid: "{{ mash_playbook_gid }}"

uptime_kuma_container_additional_networks: |
  {{
    ([mash_playbook_reverse_proxyable_services_additional_network] if mash_playbook_reverse_proxyable_services_additional_network else [])
  }}

uptime_kuma_container_labels_traefik_enabled: "{{ mash_playbook_traefik_labels_enabled }}"
uptime_kuma_container_labels_traefik_docker_network: "{{ mash_playbook_reverse_proxyable_services_additional_network }}"
uptime_kuma_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
uptime_kuma_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}"

########################################################################
#                                                                      #
# /uptime_kuma                                                         #
#                                                                      #
########################################################################
# /role-specific:uptime_kuma



# role-specific:wg_easy
########################################################################
#                                                                      #
# wg-easy                                                              #
#                                                                      #
########################################################################

wg_easy_enabled: false

wg_easy_identifier: "{{ mash_playbook_service_identifier_prefix }}wg-easy"

wg_easy_base_path: "{{ mash_playbook_base_path }}/{{ mash_playbook_service_base_directory_name_prefix }}wg-easy"

wg_easy_uid: "{{ mash_playbook_uid }}"
wg_easy_gid: "{{ mash_playbook_gid }}"

wg_easy_container_additional_networks_auto: |
  {{
    ([mash_playbook_reverse_proxyable_services_additional_network] if mash_playbook_reverse_proxyable_services_additional_network else [])
  }}

wg_easy_container_labels_traefik_enabled: "{{ mash_playbook_traefik_labels_enabled }}"
wg_easy_container_labels_traefik_docker_network: "{{ mash_playbook_reverse_proxyable_services_additional_network }}"
wg_easy_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
wg_easy_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}"

########################################################################
#                                                                      #
# /wg-easy                                                             #
#                                                                      #
########################################################################
# /role-specific:wg_easy



# role-specific:forgejo
########################################################################
#                                                                      #
# forgejo                                                              #
#                                                                      #
########################################################################

forgejo_enabled: false

forgejo_identifier: "{{ mash_playbook_service_identifier_prefix }}forgejo"

forgejo_base_path: "{{ mash_playbook_base_path }}/{{ mash_playbook_service_base_directory_name_prefix }}forgejo"

forgejo_uid: "{{ mash_playbook_uid }}"
forgejo_gid: "{{ mash_playbook_gid }}"

forgejo_systemd_required_systemd_services_list: |
  {{
    ([devture_systemd_docker_base_docker_service_name] if devture_systemd_docker_base_docker_service_name else [])
    +
    ([devture_postgres_identifier ~ '.service'] if devture_postgres_enabled and forgejo_config_database_hostname == devture_postgres_identifier else [])
  }}

forgejo_container_additional_networks_auto: |
  {{
    ([mash_playbook_reverse_proxyable_services_additional_network] if mash_playbook_reverse_proxyable_services_additional_network else [])
    +
    ([devture_postgres_container_network] if devture_postgres_enabled and forgejo_config_database_hostname == devture_postgres_identifier and forgejo_container_network != devture_postgres_container_network else [])
  }}

forgejo_container_labels_traefik_enabled: "{{ mash_playbook_traefik_labels_enabled }}"
forgejo_container_labels_traefik_docker_network: "{{ mash_playbook_reverse_proxyable_services_additional_network }}"
forgejo_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
forgejo_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}"

forgejo_config_database_hostname: "{{ devture_postgres_identifier if devture_postgres_enabled else '' }}"
forgejo_config_database_port: "{{ '5432' if devture_postgres_enabled else '' }}"
forgejo_config_database_username: "forgejo"
forgejo_config_database_password: "{{ '%s' | format(mash_playbook_generic_secret_key) | password_hash('sha512', 'db.forgejo', rounds=655555) | to_uuid }}"

########################################################################
#                                                                      #
# /forgejo                                                             #
#                                                                      #
########################################################################
# /role-specific:forgejo



# role-specific:forgejo_runner
########################################################################
#                                                                      #
# forgejo_runner                                                       #
#                                                                      #
########################################################################

forgejo_runner_enabled: false

forgejo_runner_uid: "0"
forgejo_runner_gid: "0"

forgejo_runner_identifier: "{{ mash_playbook_service_identifier_prefix }}forgejo-runner"

forgejo_runner_base_path: "{{ mash_playbook_base_path }}/{{ mash_playbook_service_base_directory_name_prefix }}forgejo-runner"

forgejo_runner_systemd_required_systemd_services_list: |
  {{
    ([devture_systemd_docker_base_docker_service_name] if devture_systemd_docker_base_docker_service_name else [])
  }}

########################################################################
#                                                                      #
# /forgejo_runner                                                      #
#                                                                      #
########################################################################
# /role-specific:forgejo_runner



# role-specific:woodpecker_ci_server
########################################################################
#                                                                      #
# woodpecker-ci-server                                                 #
#                                                                      #
########################################################################

devture_woodpecker_ci_server_enabled: false

devture_woodpecker_ci_server_identifier: "{{ mash_playbook_service_identifier_prefix }}woodpecker-ci-server"

devture_woodpecker_ci_server_uid: "{{ mash_playbook_uid }}"
devture_woodpecker_ci_server_gid: "{{ mash_playbook_gid }}"

devture_woodpecker_ci_server_base_path: "{{ mash_playbook_base_path }}/{{ mash_playbook_service_base_directory_name_prefix }}woodpecker-ci/server"

devture_woodpecker_ci_server_systemd_required_systemd_services_list: |
  {{
    ([devture_systemd_docker_base_docker_service_name] if devture_systemd_docker_base_docker_service_name else [])
    +
    ([devture_postgres_identifier ~ '.service'] if devture_postgres_enabled and devture_woodpecker_ci_server_database_datasource_hostname == devture_postgres_identifier else [])
  }}

devture_woodpecker_ci_server_container_additional_networks: |
  {{
    (
      ([mash_playbook_reverse_proxyable_services_additional_network] if mash_playbook_reverse_proxyable_services_additional_network else [])
      +
      ([devture_postgres_container_network] if devture_postgres_enabled and devture_woodpecker_ci_server_database_datasource_hostname == devture_postgres_identifier and devture_woodpecker_ci_server_container_network != devture_postgres_container_network else [])
    ) | unique
  }}

devture_woodpecker_ci_server_container_labels_traefik_enabled: "{{ mash_playbook_traefik_labels_enabled }}"
devture_woodpecker_ci_server_container_labels_traefik_docker_network: "{{ mash_playbook_reverse_proxyable_services_additional_network }}"

devture_woodpecker_ci_server_database_driver: postgres
devture_woodpecker_ci_server_database_datasource: "postgres://{{ devture_woodpecker_ci_server_database_datasource_username }}:{{ devture_woodpecker_ci_server_database_datasource_password }}@{{ devture_woodpecker_ci_server_database_datasource_hostname }}:{{ devture_woodpecker_ci_server_database_datasource_port }}/{{ devture_woodpecker_ci_server_database_datasource_db_name }}?sslmode=disable"

devture_woodpecker_ci_server_database_datasource_hostname: "{{ devture_postgres_identifier if devture_postgres_enabled else '' }}"
devture_woodpecker_ci_server_database_datasource_port: "{{ '5432' if devture_postgres_enabled else '' }}"
devture_woodpecker_ci_server_database_datasource_username: woodpecker_ci_server
devture_woodpecker_ci_server_database_datasource_password: "{{ '%s' | format(mash_playbook_generic_secret_key) | password_hash('sha512', 'woodpecker.ci', rounds=655555) | to_uuid }}"
devture_woodpecker_ci_server_database_datasource_db_name: woodpecker_ci_server

########################################################################
#                                                                      #
# /woodpecker-ci-server                                                #
#                                                                      #
########################################################################
# /role-specific:woodpecker_ci_server



# role-specific:woodpecker_ci_agent
########################################################################
#                                                                      #
# woodpecker-ci-agent                                                  #
#                                                                      #
########################################################################

devture_woodpecker_ci_agent_enabled: false

devture_woodpecker_ci_agent_identifier: "{{ mash_playbook_service_identifier_prefix }}woodpecker-ci-agent"

devture_woodpecker_ci_agent_uid: "{{ mash_playbook_uid }}"
devture_woodpecker_ci_agent_gid: "{{ mash_playbook_gid }}"

devture_woodpecker_ci_agent_base_path: "{{ mash_playbook_base_path }}/{{ mash_playbook_service_base_directory_name_prefix }}woodpecker-ci/agent"

devture_woodpecker_ci_agent_systemd_required_systemd_services_list: |
  {{
    ([devture_systemd_docker_base_docker_service_name] if devture_systemd_docker_base_docker_service_name else [])
    +
    ([devture_woodpecker_ci_server_identifier ~ '.service'] if devture_woodpecker_ci_server_enabled else [])
  }}

devture_woodpecker_ci_agent_container_additional_networks: |
  {{
    (
      ([devture_woodpecker_ci_server_container_network] if devture_woodpecker_ci_server_enabled and devture_woodpecker_ci_server_container_network != devture_woodpecker_ci_agent_container_network else [])
    ) | unique
  }}

devture_woodpecker_ci_agent_config_server: "{{ (devture_woodpecker_ci_server_identifier + ':' + devture_woodpecker_ci_server_config_grpc_addr_port | string) if devture_woodpecker_ci_agent_enabled else '' }}"

devture_woodpecker_ci_agent_config_agent_secret: "{{ devture_woodpecker_ci_server_config_agent_secret if devture_woodpecker_ci_agent_enabled else '' }}"

########################################################################
#                                                                      #
# /woodpecker-ci-agent                                                 #
#                                                                      #
########################################################################
# /role-specific:woodpecker_ci_agent



# role-specific:wordpress
########################################################################
#                                                                      #
# wordpress                                                            #
#                                                                      #
########################################################################

wordpress_enabled: false

wordpress_identifier: "{{ mash_playbook_service_identifier_prefix }}wordpress"

wordpress_base_path: "{{ mash_playbook_base_path }}/{{ mash_playbook_service_base_directory_name_prefix }}wordpress"

wordpress_uid: "{{ mash_playbook_uid }}"
wordpress_gid: "{{ mash_playbook_gid }}"

wordpress_systemd_required_systemd_services_list_auto: |
  {{
    ([(mariadb_identifier | default('mash-mariadb')) ~ '.service'] if mariadb_enabled | default(false) and wordpress_database_hostname == mariadb_identifier | default('mash-mariadb') else [])
  }}


wordpress_container_additional_networks_auto: |
  {{
    ([mash_playbook_reverse_proxyable_services_additional_network] if mash_playbook_reverse_proxyable_services_additional_network else [])
    +
    ([mariadb_identifier | default('mash-mariadb')] if mariadb_enabled | default(false) and wordpress_database_hostname == mariadb_identifier | default('mash-mariadb') and wordpress_container_network != mariadb_identifier | default('mash-mariadb') else [])
  }}

wordpress_container_labels_traefik_enabled: "{{ mash_playbook_traefik_labels_enabled }}"
wordpress_container_labels_traefik_docker_network: "{{ mash_playbook_reverse_proxyable_services_additional_network }}"
wordpress_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
wordpress_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}"


wordpress_database_hostname: "{{ mariadb_identifier if mariadb_enabled | default(false) else '' }}"
wordpress_mysql_port: "{{ '3306' if mariadb_enabled | default(false) else '' }}"
wordpress_database_password: "{{ '%s' | format(mash_playbook_generic_secret_key) | password_hash('sha512', 'db.mariadb', rounds=655555) | to_uuid }}"

########################################################################
#                                                                      #
# /wordpress                                                           #
#                                                                      #
########################################################################
# /role-specific:wordpress



# role-specific:writefreely
########################################################################
#                                                                      #
# writefreely                                                          #
#                                                                      #
########################################################################

writefreely_enabled: false

writefreely_identifier: "{{ mash_playbook_service_identifier_prefix }}writefreely"

writefreely_uid: "{{ mash_playbook_uid }}"
writefreely_gid: "{{ mash_playbook_gid }}"

writefreely_base_path: "{{ mash_playbook_base_path }}/{{ mash_playbook_service_base_directory_name_prefix }}writefreely"

writefreely_container_additional_networks_auto: |
  {{
    ([mash_playbook_reverse_proxyable_services_additional_network] if mash_playbook_reverse_proxyable_services_additional_network else [])
  }}

writefreely_container_labels_traefik_enabled: "{{ mash_playbook_traefik_labels_enabled }}"
writefreely_container_labels_traefik_docker_network: "{{ mash_playbook_reverse_proxyable_services_additional_network }}"

# role-specific:traefik
writefreely_container_labels_traefik_entrypoints: "{{ devture_traefik_entrypoint_primary }}"
writefreely_container_labels_traefik_tls_certResolver: "{{ devture_traefik_certResolver_primary }}"
# /role-specific:traefik

########################################################################
#                                                                      #
# /writefreely                                                         #
#                                                                      #
########################################################################
# /role-specific:writefreely