main.yml

---
# General
application_id: "web-app-penpot"
entity_name: "{{ application_id | entity_name }}"

PENPOT_FRONTEND_CONTAINER: "{{ lookup('config', application_id, 'services.frontend.name') }}"
PENPOT_BACKEND_CONTAINER: "{{ lookup('config', application_id, 'services.backend.name') }}"
PENPOT_EXPORTER_CONTAINER: "{{ lookup('config', application_id, 'services.exporter.name') }}"

PENPOT_FRONTEND_SERVICE: "frontend"
PENPOT_BACKEND_SERVICE: "backend"
PENPOT_EXPORTER_SERVICE: "exporter"

PENPOT_BACKEND_CONTAINER_ADDRESS: "{{ lookup('container_address', application_id, PENPOT_BACKEND_SERVICE) }}"

PENPOT_BACKEND_INTERNAL_PORT: "{{ lookup('config', application_id, 'services.backend.ports.internal.http') }}"
PENPOT_EXPORTER_INTERNAL_PORT: "{{ lookup('config', application_id, 'services.exporter.ports.internal.http') }}"

PENPOT_PUBLIC_URI: "{{ lookup('tls', application_id, 'url.base') }}"

PENPOT_SECRET_KEY: "{{ lookup('config', application_id, 'secrets.credentials.secret_key') }}"

PENPOT_ASSETS_FS_DIRECTORY: "{{ lookup('volume', 'web-app-penpot', 'assets').target }}"

PENPOT_DATABASE_USERNAME: "{{ lookup('database', application_id, 'username') }}"
PENPOT_DATABASE_NAME: "{{ lookup('database', application_id, 'name') }}"
PENPOT_DATABASE_HOST: "{{ lookup('database', application_id, 'host') }}"
PENPOT_DATABASE_PORT: "{{ lookup('database', application_id, 'port') }}"
PENPOT_DATABASE_PASSWORD: "{{ lookup('database', application_id, 'password') }}"
PENPOT_DATABASE_URI: "postgresql://{{ PENPOT_DATABASE_HOST }}:{{ PENPOT_DATABASE_PORT }}/{{ PENPOT_DATABASE_NAME }}"
PENPOT_DATABASE_MAX_POOL_SIZE: "{{ [60, [5, (((POSTGRES_MAX_CONNECTIONS | int) - 30) // ([groups[application_id] | default([]) | length, 1] | max))] | max] | min
  }}"

PENPOT_REDIS_URI: "{{ lookup('engine', 'redis', application_id, 'url') }}/0"

PENPOT_BACKEND_URI: "http://{{ PENPOT_BACKEND_SERVICE }}:{{ PENPOT_BACKEND_INTERNAL_PORT }}"
PENPOT_EXPORTER_URI: "http://{{ PENPOT_EXPORTER_SERVICE }}:{{ PENPOT_EXPORTER_INTERNAL_PORT }}"

PENPOT_SSO_ENABLED: "{{ lookup('config', application_id, 'services.sso.enabled') }}"
PENPOT_LDAP_ENABLED: "{{ lookup('config', application_id, 'services.ldap.enabled') }}"
PENPOT_NATIVE_LOGIN_ENABLED: "{{ not (PENPOT_SSO_ENABLED | bool) }}"
PENPOT_REGISTRATION_ENABLED: "{{ PENPOT_SSO_ENABLED | bool }}"

PENPOT_FLAGS: >-
  {{ 'enable-registration' if PENPOT_REGISTRATION_ENABLED | bool else 'disable-registration' }}
  {{ 'enable-login-with-password' if PENPOT_NATIVE_LOGIN_ENABLED | bool else 'disable-login-with-password' }}
  enable-prepl-server
  disable-telemetry
  disable-onboarding
  {{ 'enable-login-with-oidc' if PENPOT_SSO_ENABLED | bool else '' }}
  {{ 'enable-login-with-ldap' if PENPOT_LDAP_ENABLED | bool else '' }}

PENPOT_ADMIN_EMAIL: "{{ lookup('users', 'platform_administrator').email }}"
PENPOT_ADMIN_PASSWORD: "{{ lookup('users', 'platform_administrator').password }}"
PENPOT_ADMIN_FULLNAME: "{{ lookup('users', 'platform_administrator').username }}"

PENPOT_OIDC_CLIENT_ID: "{{ OIDC.CLIENT.ID }}"
PENPOT_OIDC_CLIENT_SECRET: "{{ OIDC.CLIENT.SECRET }}"
PENPOT_OIDC_BASE_URI: "{{ OIDC.CLIENT.ISSUER_URL }}"
PENPOT_OIDC_AUTH_URI: "{{ OIDC.CLIENT.AUTHORIZE_URL }}"
PENPOT_OIDC_TOKEN_URI: "{{ OIDC.CLIENT.TOKEN_URL }}"
PENPOT_OIDC_USER_URI: "{{ OIDC.CLIENT.USER_INFO_URL }}"
PENPOT_OIDC_SCOPES: "openid profile email"
PENPOT_SSRF_ALLOWED_HOSTS: "{{ PENPOT_OIDC_BASE_URI | regex_replace('^https?://', '') | regex_replace('[:/].*$', '') }}"

PENPOT_LDAP_HOST: "{{ LDAP.SERVER.DOMAIN }}"
PENPOT_LDAP_PORT: "{{ LDAP.SERVER.PORT }}"
PENPOT_LDAP_BASE_DN: "{{ LDAP.DN.OU.USERS }}"
PENPOT_LDAP_BIND_DN: "{{ LDAP.DN.ADMINISTRATOR.DATA }}"
PENPOT_LDAP_BIND_PASSWORD: "{{ LDAP.BIND_CREDENTIAL }}"
PENPOT_LDAP_ATTRS_USERNAME: "{{ LDAP.USER.ATTRIBUTES.ID }}"
PENPOT_LDAP_ATTRS_EMAIL: "{{ LDAP.USER.ATTRIBUTES.MAIL }}"
PENPOT_LDAP_ATTRS_FULLNAME: "{{ LDAP.USER.ATTRIBUTES.FULLNAME }}"