---
# Bao secret <mount>/data/homarr expected to contain:
#   secret_encryption_key (64 hex chars), admin_password, oidc_client_secret
_homarr: "{{ lookup('community.hashi_vault.hashi_vault', vault_mount + '/data/homarr', url=vault_addr) }}"

homarr_domain: "home.phbe.souveredu.ch"
homarr_extra_domains:
  - "home.int.phbe.souveredu.ch"
homarr_base_url: "https://home.phbe.souveredu.ch"

homarr_secret_encryption_key: "{{ _homarr.secret_encryption_key }}"
homarr_admin_username: "admin"
homarr_admin_email: "admin@phbe.souveredu.ch"
homarr_admin_password: "{{ _homarr.admin_password }}"

# OIDC against Authentik. credentials provider stays enabled as a
# break-glass account — reach it via /auth/login/credentials when
# AUTH_OIDC_AUTO_LOGIN bypasses the normal /login page.
#
# Issuer must match the `iss` claim authentik emits, which is always the
# public FQDN. Homarr (oauth4webapi) does a strict 1:1 comparison between
# the discovery response's issuer and this URL — an internal FQDN here
# fails with OAUTH_JSON_ATTRIBUTE_COMPARISON_FAILED. The public FQDN
# resolves (internal DNS view) to the DMZ reverseproxy, which the backend
# subnet can reach, so discovery/token/userinfo stay in the LAN.
homarr_auth_providers: "credentials,oidc"
homarr_oidc_issuer: "https://auth.phbe.souveredu.ch/application/o/homarr/"
homarr_oidc_client_id: "homarr"
homarr_oidc_client_secret: "{{ _homarr.oidc_client_secret }}"
homarr_oidc_client_name: "Authentik"
homarr_oidc_scopes: "openid profile email groups"
homarr_oidc_groups_attribute: "groups"
homarr_oidc_auto_login: "true"

# Default board with shortcuts to the other phbern services. Width
# values describe horizontal grid cells (1-10 desktop / 6 tablet / 2
# mobile, packed left-to-right).
homarr_apps:
  - id: nextcloud
    name: Nextcloud
    description: "Cloud Storage & Collaboration"
    icon: https://cdn.jsdelivr.net/gh/walkxcode/dashboard-icons/png/nextcloud.png
    href: https://cloud.phbe.souveredu.ch
    width: 2
  - id: collabora
    name: Collabora Office
    icon: https://cdn.jsdelivr.net/gh/walkxcode/dashboard-icons/png/collaboraonline.png
    href: https://office.phbe.souveredu.ch
    width: 2
  - id: drawio
    name: Draw.io
    icon: https://cdn.jsdelivr.net/gh/walkxcode/dashboard-icons/png/drawio.png
    href: https://draw.phbe.souveredu.ch
    width: 2
  - id: send
    name: Send
    description: "Encrypted file-share"
    icon: https://cdn.jsdelivr.net/gh/walkxcode/dashboard-icons/png/firefox-send.png
    href: https://send.phbe.souveredu.ch
    width: 2
  - id: opnform
    name: OpnForm
    description: "Self-hosted forms"
    icon: https://cdn.jsdelivr.net/gh/walkxcode/dashboard-icons/png/opnform.png
    href: https://forms.phbe.souveredu.ch
    width: 2
  - id: bookstack
    name: BookStack
    description: "Wiki & documentation"
    icon: https://cdn.jsdelivr.net/gh/walkxcode/dashboard-icons/png/bookstack.png
    href: https://wiki.phbe.souveredu.ch
    width: 2
  - id: authentik
    name: Authentik
    description: "Identity provider"
    icon: https://cdn.jsdelivr.net/gh/walkxcode/dashboard-icons/png/authentik.png
    href: https://auth.phbe.souveredu.ch
    width: 2