#!/bin/bash
# ==============================================================================================
# ========================== HOSTN CONFIGURATION — (hostname) ==================================
# ==============================================================================================
# HOSTN-specific variables — credentials, container names, share paths, failover lists.
# Sourced after master.conf — values here extend shared profile arrays and add HOSTN-specific
# identity, credentials, and container configuration.
#
# Sparse checkout (git) ensures other hosts never receive this file.
#
# DO NOT put shared config here — thresholds, toggles, profiles belong in master.conf.
# DO NOT put other hosts' variables here — they belong in their own host*.conf files.
#
# ── HOW TO USE THIS TEMPLATE ──────────────────────────────────────────────────────────────────
# This file was generated by the Varaverk first-run wizard.
# Fill in the sections that apply to your setup — leave unused sections empty.
# All scripts self-guard against empty values — safe to leave sections blank until needed.
#
# ── INDEX ─────────────────────────────────────────────────────────────────────────────────────
#
#   ── IDENTITY & CONNECTIVITY ────────────────────────────────────────────────────────────────
#   IDENTITY                hostname, SSH key, Unraid API key
#   EMBY                    container name, URL, API key
#   JELLYFIN                container name, URL, API key
#   GITEA                   API token for SSH key registration
#   NOTIFICATIONS           Discord webhook
#
#   ── PARTNERSHIP ────────────────────────────────────────────────────────────────────────────
#   PARTNERSHIP             auth containers, backup paths, emby provisioning
#
#   ── RSYNC ──────────────────────────────────────────────────────────────────────────────────
#   DAILY SYNC SHARES       media shares this host owns and pushes
#   PERSONAL SHARES         private encrypted shares for offsite backup
#   WEEKLY SYNC SHARES      appdata shares synced weekly
#   INTERMEDIATE SYNC       mid-day appdata propagation
#   CRITICAL SYNC SHARES    appdata shares synced every 30 minutes
#   BACKUP VERIFY           shares for checksum verification against remote
#   HOSTN RSYNC PROFILE     host-specific appdata sync profile
#
#   ── FALLBACK ───────────────────────────────────────────────────────────────────────────────
#   DDNS                    DDNS containers managed by this host
#   INTERNET LOSS           containers stopped when internet is lost
#   FALLBACK TIERS          what this host runs for the remote per tier
#   TIER DELAYS             delays before each tier activates
#   RSYNC WRITEBACK         appdata synced back on handback
#
#   ── DOCKER ─────────────────────────────────────────────────────────────────────────────────
#   DOCKER DAILY RESTART    containers restarted daily
#   DOCKER WEEKLY RESTART   containers restarted weekly
#   DOCKER WATCHDOG         memory limits, health URLs, required containers
#   NETWORK WATCHDOG        DDNS domain, NPM URL for connectivity checks
#   DOCKER NETWORK CONNECT  networks and containers for array start
#
#   ── MEDIA ──────────────────────────────────────────────────────────────────────────────────
#   MEDIA PERMISSIONS       share list for permissions script
#   MEDIA CLEANER           folder lists for media_cleaner.sh
#
#   ── ARR STACK ──────────────────────────────────────────────────────────────────────────────
#   DOWNLOADERS             slskd, SABnzbd, qBittorrent credentials and URLs
#   LIDARR / SONARR / RADARR  URL, API key, path map
#   ARR RECOVERY            per-arr recovery toggles
#
#   ── TRANSCODES ─────────────────────────────────────────────────────────────────────────────
#   TRANSCODES              ramdisk size, thresholds, SSD path, server array
#
#   ── MONITORS ───────────────────────────────────────────────────────────────────────────────
#   CERTIFICATE MONITOR     domains checked for SSL expiry
#   SMART HEALTH            drives to skip in SMART monitoring
#   ZFS REPORT              pools to exclude from ZFS health report
#
#   ── RESOURCE MANAGER ───────────────────────────────────────────────────────────────────────
#   RESOURCE MANAGER        containers paused/stopped under memory pressure
#
#   ── SYSTEM WATCHDOG ────────────────────────────────────────────────────────────────────────
#   SYSTEM WATCHDOG         per-host check toggles and NIC configuration
#
# ==============================================================================================

# ==============================================================================================
# ── STORAGE MODE ──────────────────────────────────────────────────────────────────────────────
# ==============================================================================================

# ━━━ Storage mode ━━━
# Controls where Varaverk stores scripts, conf, and state files.
# true  = internal NVMe/SSD — /boot/config/plugins/varaverk  (write-safe, git-direct)
# false = USB flash boot    — /mnt/user/appdata/Varaverk      (preserves flash lifetime)
# Auto-detected from boot device transport on first setup.
# To change: Settings → Storage → Migrate.
    HOST1_STORAGE_MODE_INTERNAL=true

# ==============================================================================================
# ── IDENTITY & CONNECTIVITY ───────────────────────────────────────────────────────────────────
# ==============================================================================================

# ━━━ Identity ━━━
# HOSTN hostname lives in master.conf (not a credential — safe for all servers).
# SSH key used for all server-to-server operations — rsync, failover, conf sync.
# Convention: /root/.ssh/<hostname-lowercase-no-unraid-prefix>_rsync_automation
# Must be in /root/.ssh/ and authorised in the partner's /root/.ssh/authorized_keys.
# Run Partnership/ssh_setup.sh to generate the key and copy it to the partner.
    HOST1_SSH_KEY="/root/.ssh/gmer4lfe_rsync_automation"
    HOST1_STORAGE_PATH="/mnt/user"
    HOST1_OWNER="gmer4lfe"
    HOST1_OWNER_EMAIL="gmer4lfe@gmail.com"

# ━━━ Unraid API ━━━
# Used by the Varaverk plugin to query this server's Unraid GraphQL API.
# Generate in Unraid: Settings → Management Access → API Keys → + New Key
    HOST1_UNRAID_API_KEY="1825c3a2e03ea5089974f4da2e171aa2d5907a1dea23cc479c33e492c8ff4dbb"

# ━━━ Emby ━━━
    HOST1_EMBY_CONTAINER="Emby"
    HOST1_EMBY_URL="http://localhost:8096"
    HOST1_EMBY_API_KEY="0c27448d93a7431f9ac63569f7655829"

# ━━━ Jellyfin ━━━
    HOST1_JELLYFIN_CONTAINER="Jellyfin"
    HOST1_JELLYFIN_URL="http://localhost:8095"
    HOST1_JELLYFIN_API_KEY="4e820e7df74c4933acec212b1996314e"

# ━━━ Gitea ━━━
# Personal access token for gitea_ssh_setup.sh.
# Create in Gitea: Settings → Applications → Generate Token → scope: write:user
    HOST1_GITEA_API_TOKEN=""

# ━━━ Notifications ━━━
# Discord webhook — leave blank to disable.
    HOST1_DISCORD_WEBHOOK=""

# ==============================================================================================
# ── PARTNERSHIP ───────────────────────────────────────────────────────────────────────────────
# ==============================================================================================

# Auth containers reconfigured on onboard/offboard.
# Format: "ContainerName|WebUIPort"
    HOST1_PARTNERSHIP_AUTH_WEBUIS=(
        "NginxProxyManager|81"
        "Lldap-Gmer4Lfe|17170"
        "Authelia|9091"
        "Authelia-Secondary|9092"
    )

# XML templates pushed to mirror during onboard — auth stack.
# Dependencies (databases) must come before apps that depend on them.
    HOST1_PARTNERSHIP_AUTH_STACK=(
        # Dependencies first — Mariadb/Redis must be healthy before Authelia starts
        "my-Mariadb-Authelia.xml"
        "my-Mariadb-Authelia-Secondary.xml"
        "my-Redis-Authelia.xml"
        "my-Redis-Authelia-Secondary.xml"
        # Auth apps — deployed after their deps are confirmed healthy
        "my-Authelia.xml"
        "my-Authelia-Secondary.xml"
        "my-NginxProxyManager.xml"
        "my-Lldap-Gmer4Lfe.xml"
    )

# XML templates pushed to mirror during onboard — arr stack.
    HOST1_PARTNERSHIP_ARR_STACK=(
         "my-Sonarr.xml"
         "my-Radarr.xml"
         "my-Lidarr.xml"
         "my-Prowlarr.xml"
         "my-Bazarr.xml"
    )

# Paths the partner should collect during the grace window after offboard.
    HOST1_PARTNERSHIP_MIRROR_BACKUPS=(
        # "/mnt/user/appdata-Fallback/Jayred365-Emby"
    )

# Containers parked on this server when partnership is active.
    HOST1_PARTNERSHIP_OWN_CONTAINERS=(
        # "Emby"
        # "NginxProxyManager"
    )

# Containers stopped on THIS server before deploying the mirror's stack on onboard.
    HOST1_PARTNERSHIP_REPLACE_CONTAINERS=(
    )

# Arr containers stopped on this server when mirror's arr stack is deployed.
    HOST1_PARTNERSHIP_ARR_REPLACE_CONTAINERS=(
    )

# Emby admin provisioning — owner controls whether Emby is shared.
    HOST1_PARTNERSHIP_PROVISION_EMBY_ADMIN=false   # owner controls whether Emby is shared
    HOST1_PARTNERSHIP_EMBY_PORT=8096
    HOST1_PARTNERSHIP_EMBY_ADMIN_USER=""            # this server's desired Emby username
    HOST1_PARTNERSHIP_EMBY_ADMIN_PASS=""            # this server's desired Emby password

# ==============================================================================================
# ── RSYNC ─────────────────────────────────────────────────────────────────────────────────────
# ==============================================================================================

# ━━━ Daily Sync Shares ━━━
# Media shares this host pushes to all other nodes every night.
# Uses DEFAULT_RSYNC_OPTS from master.conf — no profile needed.
    HOST1_DAILY_SYNC_SHARES=(
        /mnt/user/Books
        /mnt/user/Intros
        /mnt/user/Kids_Movies
        /mnt/user/Kids_Tv_Shows
        /mnt/user/Movies
        /mnt/user/Music
        /mnt/user/Music_Videos
        /mnt/user/Nextcloud
        /mnt/user/stand-up_comedy
        /mnt/user/Sports
#        /mnt/user/Tv_Shows
        /mnt/user/Anime_Shows-Old
        /mnt/user/Anime_Movies-Old
        /mnt/user/Anime_Movies
        /mnt/user/Anime_Shows
    )

# ━━━ Personal Shares ━━━
# Private encrypted shares synced for offsite backup, independent of media shares.
    HOST1_PERSONAL_SHARES=(
        # /mnt/user/HOST1-Personal     # uncomment after creating encrypted dataset
    )

# ━━━ Weekly Sync Shares ━━━
# Appdata shares synced during the weekly maintenance window.
# Profiles (emby, critical-data) drive container stops — define in master.conf.
    HOST1_WEEKLY_SYNC_SHARES=(
        "/mnt/user/Media_Server/Emby"               # emby profile — full clean mirror
        "/mnt/user/appdata-Fallback/Critical-Data"  # critical-data profile — auth stack
    )

# ━━━ Intermediate Sync Shares ━━━
# Shares synced every 4 hours. Leave empty to skip mid-day rsync.
    HOST1_INTERMEDIATE_SYNC_SHARES=(
        # Add shares here to enable mid-day rsync
        # Example: "/mnt/user/Emby_Metadata"
    )

# ━━━ Critical Sync Shares ━━━
# Appdata shares synced every 30 minutes.
# Format: "/path/to/share" or "/path/to/share|profile-name"
    HOST1_CRITICAL_SYNC_SHARES=(
        "/mnt/user/appdata-Fallback/Critical-Data|critical-fallback"  # auth dirty sync — stays running
        "/mnt/user/Media_Server/Emby|emby-fallback"                   # Emby dirty sync — stays running
    )

# ━━━ Backup Verify ━━━
# Leave empty to use HOST1_DAILY_SYNC_SHARES automatically.
    HOST1_BACKUP_VERIFY_SHARES=(
        # leave empty to use HOST1_DAILY_SYNC_SHARES automatically
    )

# ━━━ HOSTN Rsync Profile — hostn-appdata ━━━
# Host-specific appdata sync profile.
    PROFILE_RSYNC_OPTS[hostn-appdata]="-av --info=progress2 --bwlimit=${PROFILE_BW_LIMIT[hostn-appdata]:-8000}"
    PROFILE_BW_LIMIT[hostn-appdata]=8000
    PROFILE_RETRY_COUNT[hostn-appdata]=3
    PROFILE_SLEEP[hostn-appdata]=300
    PROFILE_CRITICAL_CONTAINER_NAMES[hostn-appdata]=""
    PROFILE_DELAYED_CONTAINERS[hostn-appdata]=""
    PROFILE_CONTAINER_DELAY[hostn-appdata]=5
    PROFILE_EXCLUDE_DIRS[hostn-appdata]="logs *.tmp"

# ==============================================================================================
# ── FALLBACK ──────────────────────────────────────────────────────────────────────────────────
# ==============================================================================================

# ━━━ DDNS ━━━
# DDNS containers this host manages.
    HOST1_DDNS_CONTAINERS=(
        "Gmer4Lfe.com"
    )

# ━━━ Internet Loss ━━━
# Containers stopped immediately when internet is lost.
    FALLBACK_HOST1_STOP_ON_NO_NET=(
        "Gmer4Lfe.com"
    )

# ━━━ Fallback Tiers — HOSTN Runs for Partner ━━━
# Containers this host starts when the partner goes down.
# Replace HOST2 below with the actual remote host ID (HOST1, HOST2, etc.)
    FALLBACK_HOST1_COVERS_HOST2_TIER1=(
        "Gmer4Lfe.us"
        "VaultWarden-Jayred365"
    )

    FALLBACK_HOST1_COVERS_HOST2_TIER2=(
        # "container-placeholder"
    )

    FALLBACK_HOST1_COVERS_HOST2_TIER3=(
        # "container-placeholder"
    )

    FALLBACK_HOST1_COVERS_HOST2_TIER4=(
        # "container-placeholder"
    )

# ━━━ Tier Delays — This Host's Outage Timers ━━━
# How long THIS host must be down before each tier activates on the partner.
    HOST1_TIER2_DELAY=240           # 4 hours  — NextCloud, Immich
    HOST1_TIER3_DELAY=720           # 12 hours — secondary services
    HOST1_TIER4_DELAY=1440          # 24 hours — arrs + downloaders

# ━━━ Rsync Writeback ━━━
    HOST1_TIER1_WRITEBACK_DELAY=60  # skip Emby writeback if outage under 1hr

    FALLBACK_HOST1_WRITEBACK_TIER1=(
        "/mnt/user/Media_Server/Emby"               # watch states built up during outage
    )

    FALLBACK_HOST1_WRITEBACK_TIER2=(
        "/mnt/user/appdata-Fallback/Important-Data" # NextCloud + Postgres — files added during outage
    )

    FALLBACK_HOST1_WRITEBACK_TIER3=(
        # "location-placeholder"
    )

    FALLBACK_HOST1_WRITEBACK_TIER4=(
        "/mnt/user/appdata-Fallback/Arrs_Stack"     # arr databases — downloads queued during outage
    )

# ==============================================================================================
# ── DOCKER ────────────────────────────────────────────────────────────────────────────────────
# ==============================================================================================

# ━━━ Docker Daily Restart ━━━
    HOST1_DAILY_RESTART_CONTAINERS=(
        "NginxProxyManager"
        "Lldap-Gmer4Lfe"
        "Authelia"
        "Authelia-Secondary"
        "Dispatcharr-Iptv-Users"
        "Dispatcharr"               # Live TV scheduler — degrades without daily restart
        "Dispatcharr-Basic"
        "ErsatzTV-Emby"
        "slskd"                     # Soulseek connection drops after extended uptime; restart refreshes share index
    )

# ━━━ Docker Weekly Restart ━━━
    HOST1_WEEKLY_RESTART_CONTAINERS=(
        "NextCloud"
        "Organizrv2-Gmer4Lfe"
        "AdGuard-Home"
        "Immich-Gmer4Lfe"
    )

# ━━━ Docker Watchdog ━━━

# Memory hard limits in MB — immediate restart if exceeded.
# 20GB=20480  16GB=16384  8GB=8192  4GB=4096  2GB=2048  1GB=1024
    declare -A HOST1_WATCHDOG_CONTAINERS=(
        ["Emby"]=20480              # 20GB — large library + active transcodes
        ["LidaTube"]=6144           # 6GB  — memory leak over time
        ["Tdarr"]=6144              # 6GB  — encoding is memory intensive
        ["Code-Server"]=1024        # 1GB  — should never need more
    )

# HTTP health check URLs — checked every cycle.
    declare -A HOST1_WATCHDOG_CONTAINER_URLS=(
        ["Emby"]="http://localhost:8096"
        ["NginxProxyManager"]="http://localhost:7818"
        ["Authelia"]="http://localhost:9091/api/health"
        ["Authelia-Secondary"]="http://localhost:9092/api/health"
        ["Lldap-Gmer4Lfe"]="http://localhost:17170"
    )

# API-level health checks. Format: ["ContainerName"]="url|expected_json_key|expected_value"
    declare -A HOST1_WATCHDOG_CONTAINER_API_CHECKS=(
    )

# Required containers — must always be running.
    HOST1_WATCHDOG_REQUIRED_CONTAINERS=(
        "NginxProxyManager"
        "Lldap-Gmer4Lfe"
        "Mariadb-Authelia"
        "Mariadb-Authelia-Secondary"
        "Redis-Authelia"
        "Redis-Authelia-Secondary"
        "Authelia"
        "Authelia-Secondary"
    )

# Containers to skip in Tier 2 global scan.
    HOST1_WATCHDOG_SCAN_IGNORE=(
        "DashGate"
        "PIA-WG-Config-Generator"
        "Aperture"
        "Aperture-Kids"
        "pgvector-18-Apeture-Kids"
        "Pgvector18-Aperture"
        "emby-test"                 # broken test container (exit 127 — bad image)
    )

# Dependency ordering — skip restarting a container if its dependency is also down.
    declare -A HOST1_WATCHDOG_DEPENDENCIES=(
        ["Authelia"]="Mariadb-Authelia Redis-Authelia"
        ["Authelia-Secondary"]="Mariadb-Authelia Redis-Authelia-Secondary"
        ["NextCloud"]="Postgres-NextCloud"
    )

# Per-container appdata growth suppress ceilings in MB.
    declare -A HOST1_WATCHDOG_APPDATA_SIZES=(
        ["Tdarr"]="25600"       # 25GB — transcode cache grows legitimately during active jobs
        ["7dtd"]="20480"        # 20GB — game server world data, expected to be large
    )

# ━━━ Network Watchdog ━━━
    HOST1_NETWORK_WATCHDOG_DDNS_DOMAIN="gmer4lfe.com"
    HOST1_NETWORK_WATCHDOG_DDNS_CONTAINER="Gmer4Lfe.com"
    HOST1_NETWORK_WATCHDOG_NPM_URL="https://gmer4lfe.com"

# ━━━ Docker Network Connect ━━━
    HOST1_NETWORK_CONNECT_CONTAINERS=(
        "memcached"
        "Npm-CrowdSec"
    )

    HOST1_NETWORK_CONNECT_NETWORKS=(
        "high-availability"
    )

# ==============================================================================================
# ── MEDIA ─────────────────────────────────────────────────────────────────────────────────────
# ==============================================================================================

# ━━━ Media Permissions ━━━
    HOST1_MEDIA_PERMISSION_SHARES=(
        /mnt/user/Anime_Movies
        /mnt/user/Anime_Movies-Old
        /mnt/user/Anime_Shows
        /mnt/user/Anime_Shows-Old
        /mnt/user/appcache
        /mnt/user/Books
        /mnt/user/Downloads
        /mnt/user/Games
        /mnt/user/Intros
        /mnt/user/Kids_Movies
        /mnt/user/Kids_Tv_Shows
        /mnt/user/Movie_Recordings
        /mnt/user/Movies
        /mnt/user/Music
        /mnt/user/Music_Videos
        /mnt/user/Photo
        /mnt/user/Sports
        /mnt/user/stand-up_comedy
        /mnt/user/Tv_Recordings
        /mnt/user/Tv_Shows
        /mnt/user/YouTube
    )

# ━━━ Media Cleaner ━━━
    HOST1_ANIME_CLEAN_FOLDERS=(
        /mnt/user/Anime_Movies
        /mnt/user/Anime_Movies-Old
        /mnt/user/Anime_Shows
        /mnt/user/Anime_Shows-Old
    )

    HOST1_MEDIA_CLEAN_FOLDERS=(
        /mnt/user/Kids_Movies
        /mnt/user/Kids_Tv_Shows
        /mnt/user/Movies
        /mnt/user/Music
        /mnt/user/Sports
        /mnt/user/stand-up_comedy
        /mnt/user/Tv_Shows
    )

# ==============================================================================================
# ── ARR STACK ─────────────────────────────────────────────────────────────────────────────────
# ==============================================================================================

# ━━━ Downloaders ━━━
    HOST1_SLSKD_URL="http://localhost:8980"
    HOST1_SLSKD_API_KEY="4bF9kL2mNpQrT7vWxYz1A3dEgHjKoRsU"
    HOST1_SLSKD_FAILED_IMPORTS_DIR="/mnt/user/Temp_Storage/Slskd/completed/failed_imports"

    HOST1_SABNZBD_URL="http://localhost:8180"
    HOST1_SABNZBD_API_KEY="8bfefe41d83b4d50883e32859b55ca9a"

    HOST1_QBIT_URL="http://localhost:8080"
    HOST1_QBIT_USERNAME="root"
    HOST1_QBIT_PASSWORD="Stay0utD!ck"

# ━━━ Lidarr ━━━
    HOST1_LIDARR_URL="http://localhost:8686"
    HOST1_LIDARR_API_KEY="b2977e71ef074bc0a0529d9fcce3b2dc"
    HOST1_LIDARR_MUSIC_ROOT="/mnt/user/Music-New"
    HOST1_FANART_API_KEY="Yd7147a43b692df0b364b94dc47efb81"
    HOST1_LASTFM_API_KEY="be6dc169c33ae263e690c30d18b7491d"

    declare -A HOST1_LIDARR_PATH_MAP=(
        ["/ext-music"]="/mnt/user/Music-New"
    )

# ━━━ Sonarr ━━━
    HOST1_SONARR_URL="http://localhost:8989"
    HOST1_SONARR_API_KEY="130decd3db5b4c25afad64864cd03f9f"
    HOST1_SONARR_TV_ROOT="/mnt/user/Tv_Shows"

    declare -A HOST1_SONARR_PATH_MAP=(
        ["/tv"]="/mnt/user/Tv_Shows"
        ["/ext-standup-comedy"]="/mnt/user/stand-up_comedy/series"
        ["/kids tv"]="/mnt/user/Kids_Tv_Shows"
        ["/ext-anime-shows"]="/mnt/user/Anime_Shows-Old"
    )

# ━━━ Radarr ━━━
    HOST1_RADARR_URL="http://localhost:7878"
    HOST1_RADARR_API_KEY="d43a3ec6cf1549edb4af0cc63f98b2a9"
    HOST1_TMDB_API_KEY="3dac5e2e49b5540472d2eafec4f01260"
    HOST1_RADARR_MOVIES_ROOT="/mnt/user/Movies"

    declare -A HOST1_RADARR_PATH_MAP=(
        ["/movies"]="/mnt/user/Movies"
        ["/kids movies"]="/mnt/user/Kids_Movies"
        ["/ext-stand-up-comedy"]="/mnt/user/stand-up_comedy/specials"
        ["/anime-movies"]="/mnt/user/Anime_Movies-Old"
        ["/ext-anime-movies"]="/mnt/user/Anime_Movies-Old"
    )

# ━━━ Arr Recovery Toggles ━━━
    HOST1_LIDARR_RECOVERY=true      # HOST1 only — exits cleanly on HOST2
    HOST1_SONARR_RECOVERY=true
    HOST1_RADARR_RECOVERY=true

# ==============================================================================================
# ── TRANSCODES ────────────────────────────────────────────────────────────────────────────────
# ==============================================================================================

    HOST1_RAMDISK_SIZE="10G"
    HOST1_RAMDISK_WARN_GB=8.5      # flip to SSD when ramdisk usage reaches this
    HOST1_RAMDISK_LOW_GB=7         # flip back to ramdisk when usage drops to this
    HOST1_TRANSCODE_SSD="/mnt/cache/Temp_Storage/Emby/Transcodes/"

    HOST1_TRANSCODE_SERVERS=(
        "${HOST1_EMBY_CONTAINER}|${HOST1_EMBY_URL}|${HOST1_EMBY_API_KEY}|emby"
        "${HOST1_JELLYFIN_CONTAINER}|${HOST1_JELLYFIN_URL}|${HOST1_JELLYFIN_API_KEY}|jellyfin"
    )

# ==============================================================================================
# ── MONITORS ──────────────────────────────────────────────────────────────────────────────────
# ==============================================================================================

# ━━━ Certificate Monitor ━━━
    HOST1_CERT_MONITOR_DOMAINS=(
        "Gmer4Lfe.com"
        "Gmer4Lfe.us"
    )

# ━━━ SMART Health ━━━
    HOST1_SMART_IGNORE_DRIVES=(
        "sda"                       # boot USB — SMART not meaningful on flash drives
    )

# ━━━ ZFS Report ━━━
    HOST1_ZFS_REPORT_IGNORE_POOLS=(
        "disk5"
        "disk6"
        "disk8"
        "disk9"
        "disk10"
    )

# ==============================================================================================
# ── RESOURCE MANAGER ──────────────────────────────────────────────────────────────────────────
# ==============================================================================================

    HOST1_RW_PAUSE_CONTAINERS=(
        "Huntarr"                       # arr search automation — safe to suspend
        "Cleanuparr"                    # download cleanup — safe to suspend
        "Healarr"                       # arr health checks — safe to suspend
        "Soularr"                       # Slskd automation — background only
        "ChannelTube"                   # YouTube archiver — background only
        "Pinchflat"                     # YouTube archiver — background only
    )

    HOST1_RW_STOP_CONTAINERS=(
        "LocalAI"                       # GPU/CPU heavy — largest RAM consumer when idle
        "7DaysToDie"                    # game server — optional
        "V-Rising"                      # game server — optional
        "Code-Server"                   # IDE — not needed during pressure events
    )

# ==============================================================================================
# ── SYSTEM WATCHDOG ───────────────────────────────────────────────────────────────────────────
# ==============================================================================================

    HOST1_SYS_WATCHDOG_NIC="eth0"

    HOST1_SYS_WATCHDOG_CHECK_DOCKER_DAEMON=true
    HOST1_SYS_WATCHDOG_CHECK_ROOTFS=true
    HOST1_SYS_WATCHDOG_CHECK_KERNEL_OOPS=true
    HOST1_SYS_WATCHDOG_CHECK_FD=true
    HOST1_SYS_WATCHDOG_CHECK_BOOT=true
    HOST1_SYS_WATCHDOG_CHECK_OOM=true
    HOST1_SYS_WATCHDOG_CHECK_RAM=true
    HOST1_SYS_WATCHDOG_CHECK_LOG=true
    HOST1_SYS_WATCHDOG_CHECK_ARC=true
    HOST1_SYS_WATCHDOG_CHECK_CPU_TEMP=true
    HOST1_SYS_WATCHDOG_CHECK_LOAD=false
    HOST1_SYS_WATCHDOG_CHECK_ZOMBIES=true
    HOST1_SYS_WATCHDOG_CHECK_CONTAINERS=true
    HOST1_SYS_WATCHDOG_CHECK_TMP=true
    HOST1_SYS_WATCHDOG_CHECK_MDSTAT=true
    HOST1_SYS_WATCHDOG_CHECK_NETWORK=true
    HOST1_SYS_WATCHDOG_CHECK_SSHD=true
    HOST1_SYS_WATCHDOG_CHECK_RUNAWAY=false

# ==============================================================================================
# ── AUTH STACK ────────────────────────────────────────────────────────────────────────────────
# ==============================================================================================
# Credentials for the Varaverk Auth Stack page (NPM, lldap, Authelia).

# ━━━ NginxProxyManager ━━━
# Admin API runs on 7818 (not 81 — 81 is the partnership WebUI port).
    HOST1_NPM_URL="http://localhost:7818"
    HOST1_NPM_USER=""                           # NPM admin email
    HOST1_NPM_PASS=""                           # NPM admin password

# ━━━ lldap ━━━
    HOST1_LLDAP_URL="http://localhost:17170"
    HOST1_LLDAP_USER="admin"                    # lldap admin username
    HOST1_LLDAP_PASS=""                         # lldap admin password

# ━━━ Authelia ━━━
    HOST1_AUTHELIA_CONFIG="/mnt/user/appdata/Authelia/configuration.yml"
    HOST1_AUTHELIA_CONTAINER="Authelia"

# ==============================================================================================
# ──────────────────────── End Of HOSTn Variables ──────────────────────────────────────────────
# ==============================================================================================