---
nbops_hostname: apps-01
nbops_fqdn: apps-01.example.internal
nbops_roles:
  - base
  - ssh
  - ufw
  - updates
  - docker
  - mtls
  - monitoring
  - traefik
  - gitea
  - immich
  - ocis
  - arr

nbops_service_routing_mode: traefik
nbops_traefik_entrypoint: web
nbops_traefik_tls: false

# Edge Traefik consumes these file-provider routes and forwards to this VM's
# internal Traefik. Internal Traefik still discovers application containers
# through Docker labels.
nbops_traefik_file_routes:
  - name: gitea
    domain: git.example.internal
    scheme: http
    port: 80
  - name: immich
    domain: photos.example.internal
    scheme: http
    port: 80

# Bind this to the VM's internal/LAN address in production.
traefik_bind_address: "10.0.10.25"
traefik_publish_entrypoints: true
traefik_domain: apps-01.example.internal
traefik_forwarded_headers_trusted_ips:
  - 10.0.0.0/8
  - 172.16.0.0/12
  - 192.168.0.0/16

gitea_domain: git.example.internal
gitea_publish_ssh: true
immich_domain: photos.example.internal
ocis_url: https://files.example.internal

arr_services:
  prowlarr:
    image: lscr.io/linuxserver/prowlarr:latest
    port: 9696
    domain: prowlarr.example.internal
  sonarr:
    image: lscr.io/linuxserver/sonarr:latest
    port: 8989
    domain: sonarr.example.internal
  radarr:
    image: lscr.io/linuxserver/radarr:latest
    port: 7878
    domain: radarr.example.internal
  lidarr:
    image: lscr.io/linuxserver/lidarr:latest
    port: 8686
    domain: lidarr.example.internal
  bazarr:
    image: lscr.io/linuxserver/bazarr:latest
    port: 6767
    domain: bazarr.example.internal