main.yml

---
application_id: "web-app-openproject"
entity_name: "{{ application_id | entity_name }}"

OPENPROJECT_VERSION: "{{ lookup('config', application_id, 'services.web.version') }}"
OPENPROJECT_IMAGE: "{{ lookup('config', application_id, 'services.web.image') }}"
OPENPROJECT_REPOSITORY: "{{ lookup('config', 'web-app-openproject', 'services.openproject.repository') }}"
OPENPROJECT_REF: "{{ lookup('config', 'web-app-openproject', 'services.openproject.ref') }}"
OPENPROJECT_WEB_SERVICE: "web"
OPENPROJECT_WEB_CONTAINER: "{{ lookup('config', application_id, 'services.' ~ OPENPROJECT_WEB_SERVICE ~ '.name') }}"
OPENPROJECT_WEB_CONTAINER_ADDRESS: "{{ lookup('container_address', application_id, OPENPROJECT_WEB_SERVICE) }}"

OPENPROJECT_ADDONS_ENABLED: "{{ lookup('config', application_id, 'addons') | dict2items | selectattr('value.enabled', 'true') | list }}"
OPENPROJECT_GITLAB_BOT: "{{ lookup('users', 'gitlab-web-app-openproject') }}"
OPENPROJECT_GITLAB_WEBHOOK_SECRET: "{{ lookup('config', application_id, 'secrets.credentials.gitlab_webhook_secret') }}"
OPENPROJECT_GITLAB_TOKEN_HELD: "{{ lookup('users', 'gitlab-web-app-openproject').tokens['web-app-openproject'] | default('') | string | trim }}"
OPENPROJECT_MIGRATION_WAIT_SECONDS: 600
OPENPROJECT_MIGRATION_POLL_SECONDS: 10
OPENPROJECT_AWAIT_MIGRATIONS_ABS: "{{ [ lookup('container', application_id, 'directories.config'), 'await_migrations.sh'] | path_join }}"
OPENPROJECT_AWAIT_MIGRATIONS_TARGET: "{{ (lookup('volume', application_id, 'await_migrations').mounts | first).target }}"
OPENPROJECT_SEEDER_SERVICE: "seeder"
OPENPROJECT_SEEDER_CONTAINER: "{{ lookup('config', application_id, 'services.' ~ OPENPROJECT_SEEDER_SERVICE ~ '.name') }}"
OPENPROJECT_CRON_CONTAINER: "{{ lookup('config', application_id, 'services.cron.name') }}"
OPENPROJECT_PROXY_CONTAINER: "{{ lookup('config', application_id, 'services.proxy.name') }}"
OPENPROJECT_WORKER_CONTAINER: "{{ lookup('config', application_id, 'services.worker.name') }}"
OPENPROJECT_APP_CONTAINERS:
  - "{{ OPENPROJECT_WEB_CONTAINER }}"
  - "{{ OPENPROJECT_WORKER_CONTAINER }}"
  - "{{ OPENPROJECT_CRON_CONTAINER }}"
  - "{{ OPENPROJECT_SEEDER_CONTAINER }}"

OPENPROJECT_DATABASE_PSQL: >-
  container exec -i {{ lookup('database', application_id, 'address') }}
  psql -U {{ lookup('database', application_id, 'username') }} -d {{ lookup('database', application_id, 'name') }}
  -v ON_ERROR_STOP=1 -tA
OPENPROJECT_DATA_VOLUME_NAME: "{{ lookup('volume', application_id, 'data').name }}"
OPENPROJECT_DATA_VOLUME_TARGET: "{{ lookup('volume', application_id, 'data').target }}"
OPENPROJECT_UPGRADE_RUN:
  - container
  - run
  - --rm
  - --name
  - "{{ entity_name }}-upgrade"
  - --env-file
  - "{{ lookup('container', application_id, 'files.env') }}"
  - --network
  - "{{ lookup('database', application_id, 'network') }}"
  - --mount
  - "type=volume,src={{ OPENPROJECT_DATA_VOLUME_NAME }},dst={{ OPENPROJECT_DATA_VOLUME_TARGET }}"

OPENPROJECT_ADMINISTRATOR_USERNAME: "{{ lookup('users', 'platform_administrator').username }}"
OPENPROJECT_ADMINISTRATOR_PASSWORD: "{{ lookup('users', 'platform_administrator').password }}"
OPENPROJECT_ADMINISTRATOR_EMAIL: "{{ lookup('users', 'platform_administrator').email }}"
OPENPROJECT_ADMIN_FORCE: "{{ lookup('config', application_id, 'services.openproject.admin.force') }}"
OPENPROJECT_ADMIN_LDAP_NAME: "{{ OPENPROJECT_LDAP.name if (OPENPROJECT_HEADER_SSO_ENABLED | bool) else '' }}"
OPENPROJECT_ADMIN_STAMP_FILE: "{{ [lookup('container', application_id, 'directories.instance'), 'admin-provision.sha256'] | path_join }}"
OPENPROJECT_ADMIN_SOURCES:
  - "{{ [role_path, 'tasks/04_admin/provision.yml'] | path_join }}"
  - "{{ [role_path, 'files/ruby/apply_settings.rb'] | path_join }}"
  - "{{ [role_path, 'files/ruby/ensure_admin_user.rb'] | path_join }}"
  - "{{ [role_path, 'files/ruby/lock_seeded_admin.rb'] | path_join }}"
  - "{{ [role_path, 'files/ruby/link_admin_to_ldap.rb'] | path_join }}"

OPENPROJECT_CACHE_CONTAINER: "{{ lookup('config', application_id, 'services.cache.name') }}"

OPENPROJECT_PLUGINS_FOLDER: "{{ lookup('container', application_id, 'directories.volumes') }}plugins/"

OPENPROJECT_DUMMY_DIR: "{{ lookup('container', application_id, 'directories.volumes') }}dummy_volume"

OPENPROJECT_EMAIL: "{{ lookup('email', application_id) }}"
OPENPROJECT_RAILS_SETTINGS:
  email_delivery_method: "smtp"
  smtp_address: "{{ OPENPROJECT_EMAIL.host }}"
  smtp_domain: "{{ OPENPROJECT_EMAIL.domain }}"
  smtp_user_name: "{{ OPENPROJECT_EMAIL.username }}"
  smtp_password: "{{ OPENPROJECT_EMAIL.password }}"
  smtp_ssl: false

OPENPROJECT_SSO_PROXY_GATED: "{{ lookup('sso', application_id, 'is_proxy_gated') }}"
OPENPROJECT_SSO_HEADER: "X-Remote-User"
OPENPROJECT_SSO_SECRET: "{{ lookup('config', application_id, 'secrets.credentials.auth_source_sso_secret') }}"
OPENPROJECT_SSO_LOGOUT_URL: "{{ lookup('tls', 'web-svc-logout', 'url.base') if (lookup('config', application_id, 'services.logout.enabled') | bool) else '' }}"
OPENPROJECT_HEADER_SSO_ENABLED: "{{ (OPENPROJECT_SSO_PROXY_GATED | bool) and (OPENPROJECT_LDAP_ENABLED | bool) }}"

OPENPROJECT_LDAP_ENABLED: "{{ lookup('config', application_id, 'services.ldap.enabled') }}"
OPENPROJECT_LDAP_FILTER_ADMINISTRATORS_ENABLED: "{{ lookup('config', application_id, 'services.openproject.ldap.filters.administrators') }}"
OPENPROJECT_LDAP_FILTER_USERS_ENABLED: "{{ lookup('config', application_id, 'services.openproject.ldap.filters.users') }}"
OPENPROJECT_LDAP_FILTERS:
  ADMINISTRATORS: "{{ '(memberOf=cn=openproject-admins,' ~ LDAP.DN.OU.ROLES ~ ')' if OPENPROJECT_LDAP_FILTER_ADMINISTRATORS_ENABLED | bool else '' }}"
  USERS: "{{ '(memberOf=cn=openproject-users,' ~ LDAP.DN.OU.ROLES ~ ')' if OPENPROJECT_LDAP_FILTER_USERS_ENABLED | bool else '' }}"

OPENPROJECT_DB_POOL: "{{ [POSTGRES_ALLOWED_AVG_CONNECTIONS | int, 20] | min }}"
OPENPROJECT_RAILS_MAX_THREADS: "{{ [POSTGRES_ALLOWED_AVG_CONNECTIONS | int, 20] | min }}"