---
# roles/nginx/defaults/main.yml

nginx_conf_dir: /etc/nginx/http.d          # Alpine nginx include dir
nginx_well_known_root: /var/www            # served for ACME HTTP-01 challenges
nginx_static_root: /srv/static             # thesis PDF lives here
nginx_proxy_pass: http://127.0.0.1:3000    # the api container
nginx_cert_dir: /etc/ssl/uacme
nginx_acme_wrapper: /usr/local/bin/acme-update-certs

# VictoriaLogs UI (vmui), proxied at https://<host>/logs/ behind basic auth
# Must match -http.pathPrefix on the victorialogs service
nginx_logs_proxy_pass: http://127.0.0.1:9428
nginx_logs_htpasswd_file: /etc/nginx/.htpasswd-logs
# "user:hash" line; the credential comes from the encrypted vault, with a
# throwaway fallback so the role still renders before the vault is imported
nginx_logs_htpasswd: "{{ vault_nginx_logs_htpasswd | default('logs:$apr1$Bb2qaSgH$TUfwUmDTRR/FpOLRu.Jnj/') }}"