---
host_role: storage
host_description: "Primary storage (ZFS), Docker services"
host_location: "London"
prometheus_location: london

docker_services:
  - jellyseerr
  - navidrome
  - slskd
  - smartctl-exporter
  - plex-exporter
  - bookshelf

# Snap-managed services (deployed by media_stack role)
snap_services:
  - overseerr

# APT-managed user services (deployed by media_stack role)
apt_user_services:
  - syncthing@pez

common_apt_repositories:
  - name: tailscale
    uris: https://pkgs.tailscale.com/stable/ubuntu
    suites: "{{ ansible_facts['distribution_release'] }}"
    components: main
    signed_by: "https://pkgs.tailscale.com/stable/ubuntu/{{ ansible_facts['distribution_release'] }}.noarmor.gpg"
  - name: jellyfin
    uris: https://repo.jellyfin.org/ubuntu
    suites: "{{ ansible_facts['distribution_release'] }}"
    components: main
    signed_by: https://repo.jellyfin.org/jellyfin_team.gpg.key
  - name: plexmediaserver
    uris: https://repo.plex.tv/deb
    suites: public
    components: main
    signed_by: https://downloads.plex.tv/plex-keys/PlexSign.v2.key

common_apt_cleanup_files:
  - /etc/apt/sources.list.d/datadog.list.distUpgrade
  - /etc/apt/sources.list.d/graphics-drivers-ubuntu-ppa-lunar.list.distUpgrade
  - /etc/apt/sources.list.d/graphics-drivers-ubuntu-ppa-lunar.sources
  - /etc/apt/sources.list.d/jcfp-ubuntu-nobetas-lunar.list.distUpgrade
  - /etc/apt/sources.list.d/jcfp-ubuntu-nobetas-lunar.sources
  - /etc/apt/sources.list.d/jellyfin.sources.distUpgrade
  - /etc/apt/sources.list.d/mediaarea.list.distUpgrade
  - /etc/apt/sources.list.d/mediaarea.sources
  - /etc/apt/sources.list.d/mono-official-stable.list.distUpgrade
  - /etc/apt/sources.list.d/nvidia-container-toolkit.list.distUpgrade
  - /etc/apt/sources.list.d/plexmediaserver.list.distUpgrade
  - /etc/apt/sources.list.d/sonarr.list.distUpgrade
  - /etc/apt/sources.list.d/tailscale.list.distUpgrade
  - /etc/apt/keyrings/jellyfin.gpg
  - /usr/share/keyrings/plexmediaserver.gpg
  - /usr/share/keyrings/mono-official-archive-keyring.gpg
  - /usr/share/keyrings/mono-official-archive-keyring.gpg~
  - /usr/share/keyrings/sonarr-keyring.gpg
  - /usr/share/keyrings/sonarr-keyring.gpg~
  - /usr/share/keyrings/nvidia-container-toolkit-keyring.gpg

zfs_pools:
  - hdd

docker_daemon_extra:
  metrics-addr: "0.0.0.0:9323"
  data-root: "/hdd/docker"
  storage-driver: "zfs"

common_ufw_allowed_ports:
  - { port: 32400, proto: tcp, comment: "Plex Media Server" }
  - { port: 6881, proto: tcp, comment: "BitTorrent" }
  - { port: 6881, proto: udp, comment: "BitTorrent" }
  # SMB is reachable over Tailscale via the tailscale0 allow-all rule; this
  # entry additionally allows the local London LAN. Deliberately NOT open to
  # the public internet (see PESO-145).
  - { port: 445, proto: tcp, from_ip: "192.168.1.0/24", comment: "Samba (LAN only)" }