---
# Copyright 2016, Rackspace US, Inc.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

## OpenStack Source Code Release
openstack_release: "{{ lookup('env', 'OSA_VERSION') | default('undefined', true) }}"

## OpenStack Configuration directory
openstack_config_dir: "{{ lookup('env', 'OSA_CONFIG_DIR') | default('/etc/openstack_deploy') }}"

## OpenStack service python version
openstack_venv_python_executable: "{{ (ansible_distribution == 'CentOS') | ternary('python2', 'python3') }}"

#uwsgi venv deploys the same python version as OpenStack service venv
uwsgi_python_executable: "{{ openstack_venv_python_executable }}"

## Verbosity Options
debug: False

## SSH connection wait time
ssh_delay: 5

# Set the package install state for distribution packages
# Options are 'present' and 'latest'.
# NOTE(mhayden): Allowing CentOS 7 and openSUSE to use package_state=present should give
# gate jobs a better chance to finish and expose more issues to fix.
package_state: "{{ (ansible_pkg_mgr in ['dnf', 'yum', 'zypper']) | ternary('present', 'latest') }}"

# Set "/var/log" to be a bind mount to the physical host.
default_bind_mount_logs: true

# Set distro variable
# NOTE(hwoarang): ansible_distribution may return a string with spaces
# such as "openSUSE Leap" so we need to replace the space with underscore
# in order to create a more sensible repo name for the distro.
os_distro_version: "{{ (ansible_distribution | lower) | replace(' ', '_') }}-{{ ansible_distribution_version.split('.')[:2] | join('.') }}-{{ ansible_architecture | lower }}"

# Set the systemd prefix based on the base OS.
systemd_utils_distro_prefix:
  apt: "/lib/systemd"
  yum: "/lib/systemd"
  dnf: "/lib/systemd"
  zypper: "/usr/lib/systemd"

systemd_utils_prefix: "{{ systemd_utils_distro_prefix[ansible_pkg_mgr] }}"

# Ensure that the package state matches the global setting
rsyslog_client_package_state: "{{ package_state }}"
# At this time there's no suitable package available for systemd-journal-remote/gateway
# When installing on SUSE 42.x. For now this playbook will omit suse when the package
# manager is "zypper". When a suitable package is available on SUSE this should be removed.
rsyslog_client_enabled: "{{ ansible_pkg_mgr == 'zypper' }}"
rsyslog_server_enabled: "{{ ansible_pkg_mgr == 'zypper' }}"

# URL for the frozen internal openstack repo.
repo_server_port: 8181

## Default installation method for OpenStack services
install_method: "source"

## DNS resolution (resolvconf) options
#Group containing resolvers to configure
resolvconf_resolver_group: unbound

# Disable /etc/hosts management if unbound DNS resolution containers exist
openstack_host_manage_hosts_file: "{{ groups['unbound'] is not defined or groups['unbound'] | length < 1 }}"

## Enable external SSL handling for general OpenStack services
openstack_external_ssl: true

## OpenStack global Endpoint Protos
openstack_service_publicuri_proto: https
openstack_service_adminuri_proto: http
openstack_service_internaluri_proto: http

## Region Name
service_region: RegionOne

## OpenStack Domain
openstack_domain: openstack.local
lxc_container_domain: "{{ container_domain }}"
container_domain: "{{ openstack_domain }}"

## DHCP Domain Name
dhcp_domain: openstacklocal

## LDAP enabled toggle
service_ldap_backend_enabled: "{{ keystone_ldap is defined and keystone_ldap.Default is defined }}"

## Base venv configuration
venv_tag: "{{ openstack_release }}"

## Gnocchi
# Used in both Gnocchi and Swift roles.
gnocchi_service_project_name: "{{ (gnocchi_storage_driver is defined and gnocchi_storage_driver == 'swift') | ternary('gnocchi_swift', 'service') }}"

## OpenStack Openrc
openrc_os_auth_url: "{{ keystone_service_internalurl }}"
openrc_os_password: "{{ keystone_auth_admin_password }}"
openrc_os_domain_name: "Default"
openrc_region_name: "{{ service_region }}"

## Host security hardening
# The ansible-hardening role provides security hardening for hosts
# by applying security configurations from the STIG. Hardening is enabled by
# default, but an option to opt out is available by setting the following
# variable to 'false'.
# Docs: https://docs.openstack.org/ansible-hardening/latest/
apply_security_hardening: true

## Ansible ssh configuration
ansible_ssh_extra_args: >
  -o UserKnownHostsFile=/dev/null
  -o StrictHostKeyChecking=no
  -o ServerAliveInterval=64
  -o ServerAliveCountMax=1024
  -o Compression=no
  -o TCPKeepAlive=yes
  -o VerifyHostKeyDNS=no
  -o ForwardX11=no
  -o ForwardAgent=yes
  -T

# Toggle whether the service is deployed in a container or not
is_metal: >-
  {{ (properties is defined) and
     (properties.is_metal is defined) and
     (properties.is_metal | bool) }}

_global_pins_file_path: >-
  {{ (lookup('env', 'OSA_CLONE_ROOT') | default('/opt/openstack-ansible', true)) ~ '/global-requirement-pins.txt' }}

venv_build_global_constraints: >-
  {{ lookup('file', _global_pins_file_path).splitlines() | reject('match','^#.*$') | reject('equalto', '') | list }}