# Copy to hosts.ini and fill in your own values. hosts.ini is git-ignored so a
# real inventory never ends up in the repository.
[local]
localhost ansible_connection=local

[servers]
# Replace with your server hostname or IP, or an alias from your ~/.ssh/config.
# Example: mynextscreen.example.com ansible_user=mynextscreen
your-server

[servers:vars]
ansible_become=true
ansible_become_method=sudo
# Required: The domain name for the myNextScreen server
# Example: domain_name=mynextscreen.example.com
domain_name=mynextscreen.example.com
# Required: strong random secret for signing access JWTs. DO NOT commit a real
# value — set via Ansible Vault or --extra-vars (openssl rand -base64 48).
# jwt_access_secret="{{ vault_jwt_access_secret }}"
# Required: Postgres password. No default — the deploy fails without it.
# vault_mynextscreen_postgres_password="{{ vault_mynextscreen_postgres_password }}"
# The first super-admin is created via the UI first-run setup after deploy
# (no env seeding) — open the app while no user exists yet.
# Optional: enables the Prometheus endpoint /api/metrics (openssl rand -base64 32).
# Unset keeps it disabled. Caddy blocks it publicly; scrape localhost:50002.
# metrics_scrape_token="{{ vault_metrics_scrape_token }}"
caddy_site_prefix=70

ffmpeg_video_strip_audio=true
ffmpeg_video_crf=24
ffmpeg_video_maxrate=4M
ffmpeg_video_bufsize=8M

[site_agents]
# One line per venue. The agent runs inside the venue LAN, not on the server.
# Example: venue-north.lan ansible_user=ops
# your-venue-host

[site_agents:vars]
ansible_become=true
ansible_become_method=sudo
# Required: https address of the myNextScreen server. Plain http is refused —
# the pin is the only thing between the agent and a rogue server on the LAN.
site_agent_server_url=https://app.mynextscreen.example.com
# First run only: a setup code from the dashboard (OrgAdmin → "Add a site
# agent"). Single-use and short-lived, so pass it on the command line instead of
# storing it here:
#   ansible-playbook -i hosts.ini site-agent.yml -K -e site_agent_enrolment_token=<code>
# 0 disables the setup interface entirely — an agent enrolled through the
# environment has no reason to open an inbound port.
site_agent_setup_port=8787