---
# roles/container_isolation/vars/main.yml
#
# Single source of truth for container service accounts. Mirrors
# files/passwd.containers and files/group.containers — keep in sync if
# you edit one, edit the other. Append-only: never renumber existing
# UIDs/GIDs once folders have been chowned on the NFS server.

jerick_user: jerick

# Every container service account. uid == primary gid for each.
# jerick is added as a secondary member of every app's primary group
# in the group sync task, giving him rw access (770) without weakening
# isolation between apps.
container_apps:
  - { name: "2fauth",             uid: 2000 }
  - { name: "audiobookshelf",     uid: 2001 }
  - { name: "authelia",           uid: 2002 }
  - { name: "bazarr",             uid: 2003 }
  - { name: "cronjobs",           uid: 2004 }
  - { name: "dashy",              uid: 2005 }
  - { name: "dingus-archiver",    uid: 2006 }
  - { name: "finance-app",        uid: 2007 }
  - { name: "firefly3",           uid: 2008 }
  - { name: "gitea",              uid: 2009 }
  - { name: "gotify",             uid: 2010 }
  - { name: "immich",             uid: 2011 }
  - { name: "it-tools",           uid: 2012 }
  - { name: "jellyfin",           uid: 2013 }
  - { name: "joplin",             uid: 2014 }
  - { name: "kiwix",              uid: 2015 }
  - { name: "music-orchestrator", uid: 2016 }
  - { name: "nginxproxy",         uid: 2017 }
  - { name: "ombi",               uid: 2018 }
  - { name: "picoshare",          uid: 2019 }
  - { name: "prowlarr",           uid: 2020 }
  - { name: "qbittorrent",        uid: 2021 }
  - { name: "radarr",             uid: 2022 }
  - { name: "romm",               uid: 2023 }
  - { name: "sonarr",             uid: 2024 }
  - { name: "tandoor_recipes",    uid: 2025 }
  - { name: "vault",              uid: 2026 }
  - { name: "book-downloader",    uid: 2027 }

# Shared secondary groups for cross-container access. "members" lists
# app names from container_apps that need to be added to this group
# IN ADDITION to their own primary group. jerick is added automatically
# to every shared group as well as every per-app primary group — see
# tasks/sync_users.yml.
shared_groups:
  - name: mediapipeline
    gid: 3000
    members:
      - bazarr
      - prowlarr
      - qbittorrent
      - radarr
      - sonarr
      - jellyfin
  - name: bookpipeline
    gid: 3001
    members:
      - audiobookshelf
      - book-downloader