main.yml

---
application_id: "web-app-gitea"
entity_name: "{{ application_id | entity_name }}"

GITEA_LDAP_SOURCE_NAME: "LDAP"
GITEA_LDAP_SOURCE_TYPE: "LDAP (via BindDN)"
GITEA_LDAP_AUTH_ARGS:
  - '--name "{{ GITEA_LDAP_SOURCE_NAME }}"'
  - '--host "{{ LDAP.SERVER.DOMAIN }}"'
  - "--port {{ LDAP.SERVER.PORT }}"
  - '--security-protocol "{{ LDAP.SERVER.SECURITY | trim or "unencrypted" }}"'
  - '--bind-dn "{{ LDAP.DN.ADMINISTRATOR.DATA }}"'
  - '--user-search-base "{{ LDAP.DN.OU.USERS }}"'
  - '--user-filter "(&(objectClass=inetOrgPerson)(uid=%s))"'
  - '--admin-filter "(memberOf=cn={{ application_id }}-administrator,{{ LDAP.DN.OU.ROLES }})"'
  - '--username-attribute "{{ LDAP.USER.ATTRIBUTES.ID }}"'
  - '--firstname-attribute "{{ LDAP.USER.ATTRIBUTES.FIRSTNAME }}"'
  - '--surname-attribute "{{ LDAP.USER.ATTRIBUTES.SURNAME }}"'
  - '--email-attribute "{{ LDAP.USER.ATTRIBUTES.MAIL }}"'
  - '--public-ssh-key-attribute "{{ LDAP.USER.ATTRIBUTES.SSH_PUBLIC_KEY }}"'
  - "--synchronize-users"
GITEA_OIDC_SOURCE_NAME: "SSO Login"
GITEA_CONTAINER: "{{ lookup('config', application_id, 'services.gitea.name') }}"
GITEA_CONTAINER_ADDRESS: "{{ lookup('container_address', application_id, entity_name) }}"
GITEA_USER: "git"
GITEA_CONFIG: "/data/gitea/conf/app.ini"
GITEA_LOOPBACK_VERSION_URL: "http://127.0.0.1:{{ lookup('config', application_id, 'services.gitea.ports.internal.http') }}/api/v1/version"

GITEA_DESIGN_ENABLED: "{{ lookup('config', application_id, 'services.design.enabled') | bool }}"
GITEA_DESIGN_DIR: "{{ [lookup('container', application_id, 'directories.config'), 'design'] | path_join }}"
GITEA_THEME_DIR: "/data/gitea/public/assets/css"
GITEA_THEMES:
  auto: corporate-auto
  light: corporate-light
  dark: corporate-dark
GITEA_THEMES_COLORBLIND:
  - gitea-auto-protanopia-deuteranopia
  - gitea-auto-tritanopia
  - gitea-light-protanopia-deuteranopia
  - gitea-light-tritanopia
  - gitea-dark-protanopia-deuteranopia
  - gitea-dark-tritanopia
GITEA_THEMES_OFFERED: "{{ GITEA_THEMES.values() | list + GITEA_THEMES_COLORBLIND }}"

GITEA_REDIS_ENABLED: "{{ lookup('config', application_id, 'services.redis.enabled') }}"
GITEA_REDIS_ADDRESS: "{{ lookup('engine', 'redis', application_id, 'host') }}:{{ lookup('engine', 'redis', application_id, 'port') }}"
GITEA_REDIS_PASSWORD: "{{ lookup('engine', 'redis', application_id, 'password') }}"

GITEA_INTERNAL_API_URL: "{{ lookup('container_url', application_id, 'gitea') }}/api/v1"

GITEA_MCP_ENABLED: "{{ lookup('config', application_id, 'services.giteamcp.enabled') | bool }}"
GITEA_MCP_SERVICE_KEY: "{{ lookup('config', application_id, 'mcp.endpoint.service_key') }}"
GITEA_MCP_CONTAINER: "{{ lookup('config', application_id, 'services.giteamcp.name') }}"
GITEA_MCP_PORT: "{{ lookup('config', application_id, 'services.giteamcp.ports.internal.http') }}"
GITEA_MCP_SIDECAR_SERVICE_KEY: giteamcpupstream
GITEA_MCP_UPSTREAM_NETWORK: "{{ lookup('config', application_id, 'mcp.adapter.upstream_network') }}"
GITEA_MCP_SIDECAR_CONTAINER: "{{ lookup('config', application_id, 'services.giteamcpupstream.name') }}"
GITEA_MCP_SIDECAR_PORT: "{{ lookup('config', application_id, 'services.giteamcpupstream.ports.internal.http') }}"
GITEA_MCP_SIDECAR_URL: "http://{{ GITEA_MCP_SIDECAR_SERVICE_KEY }}:{{ GITEA_MCP_SIDECAR_PORT }}/mcp"
GITEA_MCP_INSTANCE_DIR: "{{ [lookup('container', application_id, 'directories.instance'), 'mcp'] | path_join }}"
GITEA_MCP_BEARER: "{{ lookup('config', application_id, 'secrets.credentials.mcp_bearer') }}"
GITEA_MCP_CONTRACT:
  upstream_kind: mcp
  provider: "{{ application_id }}"
  upstream_url: "{{ GITEA_MCP_SIDECAR_URL }}"
  auth_subject: "{{ lookup('config', application_id, 'mcp.auth_subject') }}"
  mutating_tools_enabled: "{{ lookup('config', application_id, 'mcp.tools.mutating_tools_enabled') | bool }}"
  tools: "{{ lookup('file', 'mcp/tools.json') | from_json }}"
  limits: "{{ lookup('config', application_id, 'mcp.limits') }}"
  schema_sha256: "{{ lookup('config', application_id, 'mcp.tools.schema_sha256') }}"
GITEA_MCP_UPSTREAM_URL: "{{ lookup('container_url', application_id, 'gitea') }}"
GITEA_MCP_TOKEN_NAME: "gitea-mcp"
GITEA_MCP_TOKEN_SCOPES: "read:repository,read:issue,read:user,read:organization,read:notification"
GITEA_MCP_ACCOUNT: "{{ lookup('users', 'mcp-web-app-gitea') }}"
GITEA_MCP_USERNAME: "{{ GITEA_MCP_ACCOUNT.username }}"
GITEA_MCP_USER_EMAIL: "{{ GITEA_MCP_ACCOUNT.email }}"
GITEA_MCP_USER_PASSWORD: "{{ GITEA_MCP_ACCOUNT.password }}"
GITEA_MCP_TOOL_SCOPES: "user,repository,issue,pull_request,search,file,branch,tag,commit,release"
GITEA_MCP_COMMAND:
  - "/app/gitea-mcp" # nocheck: literal-path  image ships no ENTRYPOINT, so command must carry the binary
  - "-t"
  - "http"
  - "--port"
  - "{{ GITEA_MCP_SIDECAR_PORT | string }}"
  - "-r"
GITEA_MCP_INITIALIZE_PAYLOAD:
  jsonrpc: "2.0"
  id: 1
  method: initialize
  params:
    protocolVersion: "2025-03-26"
    capabilities: {}
    clientInfo:
      name: infinito-nexus
      version: "1"

GITEA_OIDC_ENABLED: "{{ lookup('config', application_id, 'services.sso.shared') | bool }}"
GITEA_LDAP_ENABLED: "{{ lookup('config', application_id, 'services.ldap.enabled') }}"
GITEA_IAM_ENABLED: "{{ (GITEA_OIDC_ENABLED | bool) or ( GITEA_LDAP_ENABLED | bool ) }}"