---
# Sanitized control-plane inventory. Canonical human-readable facts remain
# in ../../inventory/hosts.md and ../../hosts/*.md. No passwords, keys, tokens,
# repository URLs, or private material belong here.
all:
  vars:
    ansible_user: windy
    ansible_ssh_common_args: >-
      -o BatchMode=yes -o ConnectTimeout=10 -o AddressFamily=inet
    ansible_become: true
    ansible_become_method: sudo
  children:
    managed:
      hosts:
        mx2:
          ansible_host: mx2.windy.me
          ansible_host_ipv4: 194.163.160.244
          display_name: mx2.windy.me
          service_role: mailcow
          compose_project_dir: /opt/mail
          healthcheck_profiles: [mailcow]
          service_reconcile_services:
            all:
              compose_args: [--force-recreate]
        us2:
          ansible_host: us2.wsvc.info
          ansible_host_ipv4: 193.9.44.165
          display_name: us2.wsvc.info
          service_role: vaultwarden
          compose_project_dir: /opt/vaultwarden
          compose_repo_project: vaultwarden
          compose_remote_file: docker-compose.yml
          healthcheck_profiles: [vaultwarden]
          restic_backup_profile: vaultwarden
          service_reconcile_services:
            vaultwarden:
              compose_args: [--force-recreate]
          service_reconcile_traefik_restart_targets: [vaultwarden]
        hk2:
          ansible_host: hk2.chans.xyz
          ansible_host_ipv4: 154.36.174.161
          display_name: hk2.chans.xyz
          service_role: powerdns
          compose_project_dir: /opt/pdns
          compose_repo_project: pdns
          compose_remote_file: compose.yml
          healthcheck_profiles: [pdns, rustdesk, hk2aux]
          restic_backup_profile: pdns
          service_reconcile_services:
            auth:
              compose_args: [--force-recreate]
            poweradmin:
              compose_args: [--no-deps, --force-recreate]
            backup:
              compose_args: [--no-deps, --force-recreate]
          service_reconcile_traefik_restart_targets: [poweradmin]
          # RustDesk server (same host, separate compose project)
          rustdesk_compose_dir: /opt/rustdesk
          rustdesk_relay: hk2.chans.xyz:21117
          rustdesk_image: rustdesk/rustdesk-server:1.1.14
        us4:
          ansible_host: us4.wsvc.info
          ansible_host_ipv4: 185.201.226.122
          display_name: us4.wsvc.info
          service_role: wireguard
          compose_project_dir: /opt/wireguard
          healthcheck_profiles: [wireguard]
          wireguard_image: >-
            lscr.io/linuxserver/wireguard@sha256:ac43e1226878d2611315172d6ea357a95cb326ee73124b91108118efc8666889
          service_reconcile_services:
            wireguard:
              compose_args: [--no-deps, --force-recreate]
        dns_windy_lan:
          ansible_host: 192.168.66.36
          ansible_host_ipv4: 192.168.66.36
          display_name: dns.windy.lan
          service_role: adguardhome
          compose_project_dir: /opt/adguardhome
          healthcheck_profiles: [adguardhome]
          service_reconcile_services:
            adguardhome:
              compose_args: [--no-deps, --force-recreate]
    mailcow:
      hosts:
        mx2:
    vaultwarden:
      hosts:
        us2:
    powerdns:
      hosts:
        hk2:
    rustdesk:
      hosts:
        hk2:
    wireguard:
      hosts:
        us4:
    adguardhome:
      hosts:
        dns_windy_lan:
    unifi:
      hosts:
        ubnt:
          ansible_host: 192.168.66.46
          ansible_host_ipv4: 192.168.66.46
          display_name: ubnt
      vars:
        service_role: unifi
        compose_project_dir: /home/windy/unifi-9
        unifi_container: unifi-controller
        unifi_mongo_port: 27117
    docker_hosts:
      children:
        mailcow:
        vaultwarden:
        powerdns:
        wireguard:
        adguardhome:
        unifi:
    # Matrix is a dedicated K3s node and intentionally remains outside the
    # Docker-oriented managed group.
    k3s_servers:
      hosts:
        matrix_vps:
          ansible_host: 169.58.86.13
          ansible_host_ipv4: 169.58.86.13
          display_name: synapse.chans.xyz
          service_role: matrix_k3s
          matrix_server_name: chans.xyz
          matrix_synapse_host: synapse.chans.xyz
          matrix_element_host: chat.chans.xyz
          matrix_mas_host: account.chans.xyz
          matrix_admin_host: admin.chans.xyz
          matrix_rtc_host: mrtc.chans.xyz
          matrix_backup_path: /var/backups/matrix
          matrix_bootstrap_dir: /etc/matrix-bootstrap
          matrix_stack_enabled: false
          # ESS OCI chart configuration
          matrix_stack_chart_ref: oci://ghcr.io/element-hq/ess-helm/matrix-stack
          matrix_stack_chart_version: 26.7.2
          matrix_stack_release_name: ess
          matrix_namespace: ess
    matrix:
      children:
        k3s_servers:
    matrix_production:
      children:
        matrix: