---
#  NOTE: This cannot be overriden in the inventory file unless used as host_vars
perforce_domain: "example.com"
perforce_mailfrom_email: "perforce-admin@{{ perforce_domain }}"
perforce_mailto_email: "rustyjackson@{{ perforce_domain }}"
perforce_smtp_server: "smtp.{{ perforce_domain }}"
update_dependencies: true

new_sdp: true
new_p4d: false
p4d_enabled: true
install_broker: true

perforce_id: "1"
perforce_case_sensitive: "0"
perforce_service: "p4d_{{ perforce_id }}"
perforce_ssl_prefix: ""
perforce_p4_port: "1666"
perforce_p4broker_port: "ssl:1667"
perforce_p4broker_target_port: "1666"

perforce_user: "perforce"
perforce_uid: "10666"
perforce_group: "perforce"
perforce_gid: "10666"
commit_dns: "perforce-commit.p4.example.com"
perforce_version: "25.2"
perforce_broker_version: "25.2"

perforce_admin_user: "p4admin"
# Override with ansible-vault in production
perforce_admin_user_pass: "F@stSCM!"

# Password hash created with: openssl passwd -6 -salt saltsecret
# Override with ansible-vault in production
perforce_user_password: "$6$PerforceRules$DahgNsXI/V89vqPAXzwflxe7wU09fotIVI5waJACxVd01.EQpQqd5zdnbtgaV.ylstYfQq30xGEBC7yznkE6X1"

# Additional admin users to create sudoers files for
admin_users:
  - russelljackson

# --- Group resource guardrails: fleet-wide naming convention ---------------
# The role templates the SDP keep_group_unset.py trigger and update_limits.py
# from these, so no group/user name is hardcoded. Override per commit server in
# host_vars if an environment uses different names. The per-environment limit
# VALUES and the enable flag live in each commit server's host_vars.
guardrails_enabled: false                 # fleet default; flip per commit server
# Every group name is its own variable -- referenced by the templated trigger,
# the membership updater, and the per-environment p4_group_limits in host_vars.
p4_baseline_group: limits                 # populated with all users by update_limits.py
p4_integrators_group: integrators         # standing elevated access
p4_unlimited_group: p4-unlimited          # approval-gated, unlimited everything
p4_admins_group: p4-admins                # admin group (trigger-exempt)
p4_replicas_group: p4-replicas            # replication service group (trigger-exempt)
p4_trigger_exempt_users:                  # users the trigger never rewrites
  - "{{ perforce_admin_user }}"
p4_trigger_exempt_groups:                 # groups allowed to keep elevated/unlimited Max*
  - "{{ p4_admins_group }}"
  - "{{ p4_replicas_group }}"
  - "{{ p4_unlimited_group }}"