Varaverk/Deployment/host.conf.template

#!/bin/bash
# ==============================================================================================
# ========================== HOSTN CONFIGURATION — (hostname) ==================================
# ==============================================================================================
# HOSTN-specific variables — credentials, container names, share paths, failover lists.
# Sourced after master.conf — values here extend shared profile arrays and add HOSTN-specific
# identity, credentials, and container configuration.
#
# Sparse checkout (git) ensures other hosts never receive this file.
#
# DO NOT put shared config here — thresholds, toggles, profiles belong in master.conf.
# DO NOT put other hosts' variables here — they belong in their own host*.conf files.
#
# ── HOW TO USE THIS TEMPLATE ──────────────────────────────────────────────────────────────────
# This file was generated by the Varaverk first-run wizard.
# Fill in the sections that apply to your setup — leave unused sections empty.
# All scripts self-guard against empty values — safe to leave sections blank until needed.
#
# ── INDEX ─────────────────────────────────────────────────────────────────────────────────────
#
#   ── IDENTITY & CONNECTIVITY ────────────────────────────────────────────────────────────────
#   IDENTITY                hostname, SSH key, Unraid API key
#   EMBY                    container name, URL, API key
#   JELLYFIN                container name, URL, API key
#   GITEA                   API token for SSH key registration
#   NOTIFICATIONS           Discord webhook
#
#   ── PARTNERSHIP ────────────────────────────────────────────────────────────────────────────
#   PARTNERSHIP             auth containers, backup paths, emby provisioning
#
#   ── RSYNC ──────────────────────────────────────────────────────────────────────────────────
#   DAILY SYNC SHARES       media shares this host owns and pushes
#   PERSONAL SHARES         private encrypted shares for offsite backup
#   WEEKLY SYNC SHARES      appdata shares synced weekly
#   INTERMEDIATE SYNC       mid-day appdata propagation
#   CRITICAL SYNC SHARES    appdata shares synced every 30 minutes
#   BACKUP VERIFY           shares for checksum verification against remote
#   HOSTN RSYNC PROFILE     host-specific appdata sync profile
#
#   ── FALLBACK ───────────────────────────────────────────────────────────────────────────────
#   DDNS                    DDNS containers managed by this host
#   INTERNET LOSS           containers stopped when internet is lost
#   FALLBACK TIERS          what this host wants the partner to run when this host is down
#   TIER DELAYS             how long this host must be down before each tier activates
#   RSYNC WRITEBACK         appdata synced back on handback
#
#   ── DOCKER ─────────────────────────────────────────────────────────────────────────────────
#   DOCKER DAILY RESTART    containers restarted daily
#   DOCKER WEEKLY RESTART   containers restarted weekly
#   DOCKER WATCHDOG         memory limits, health URLs, required containers
#   NETWORK WATCHDOG        DDNS domain, NPM URL for connectivity checks
#   DOCKER NETWORK CONNECT  networks and containers for array start
#
#   ── MEDIA ──────────────────────────────────────────────────────────────────────────────────
#   MEDIA PERMISSIONS       share list for permissions script
#   MEDIA CLEANER           folder lists for media_cleaner.sh
#
#   ── ARR STACK ──────────────────────────────────────────────────────────────────────────────
#   DOWNLOADERS             slskd, SABnzbd, qBittorrent credentials and URLs
#   LIDARR / SONARR / RADARR  URL, API key, path map
#   ARR RECOVERY            per-arr recovery toggles
#
#   ── TRANSCODES ─────────────────────────────────────────────────────────────────────────────
#   TRANSCODES              ramdisk size, thresholds, SSD path, server array
#
#   ── MONITORS ───────────────────────────────────────────────────────────────────────────────
#   CERTIFICATE MONITOR     domains checked for SSL expiry
#   SMART HEALTH            drives to skip in SMART monitoring
#   ZFS REPORT              pools to exclude from ZFS health report
#
#   ── RESOURCE MANAGER ───────────────────────────────────────────────────────────────────────
#   RESOURCE MANAGER        containers paused/stopped under memory pressure
#
#   ── SYSTEM WATCHDOG ────────────────────────────────────────────────────────────────────────
#   SYSTEM WATCHDOG         per-host check toggles and NIC configuration
#
# ==============================================================================================

# ==============================================================================================
# ── STORAGE MODE ──────────────────────────────────────────────────────────────────────────────
# ==============================================================================================

# ━━━ Storage mode ━━━
# Controls where Varaverk stores scripts, conf, and state files.
# true  = internal NVMe/SSD — /boot/config/plugins/varaverk  (write-safe, git-direct)
# false = USB flash boot    — /mnt/user/appdata/Varaverk      (preserves flash lifetime)
# Auto-detected from boot device transport on first setup.
# To change: Settings → Storage → Migrate.
    HOSTN_STORAGE_MODE_INTERNAL=false

# ==============================================================================================
# ── IDENTITY & CONNECTIVITY ───────────────────────────────────────────────────────────────────
# ==============================================================================================

# ━━━ Identity ━━━
# HOSTN hostname lives in master.conf (not a credential — safe for all servers).
# SSH key used for all server-to-server operations — rsync, failover, conf sync.
# Convention: /root/.ssh/<hostname-lowercase-no-unraid-prefix>_rsync_automation
# Must be in /root/.ssh/ and authorised in the partner's /root/.ssh/authorized_keys.
# Run Partnership/ssh_setup.sh to generate the key and copy it to the partner.
    HOSTN_SSH_KEY=""            # e.g. /root/.ssh/myserver_rsync_automation
    HOSTN_STORAGE_PATH="/mnt/user"
    HOSTN_OWNER=""              # short identifier for this server (e.g. myserver)
    HOSTN_OWNER_EMAIL=""

# ━━━ Unraid API ━━━
# Used by the Varaverk plugin to query this server's Unraid GraphQL API.
# Generate in Unraid: Settings → Management Access → API Keys → + New Key
    HOSTN_UNRAID_API_KEY=""

# ━━━ Emby ━━━
    HOSTN_EMBY_CONTAINER="Emby"
    HOSTN_EMBY_URL="http://localhost:8096"
    HOSTN_EMBY_API_KEY=""   # Emby Dashboard → API Keys → + New Key

# ━━━ Jellyfin ━━━
    HOSTN_JELLYFIN_CONTAINER="Jellyfin"
    HOSTN_JELLYFIN_URL="http://localhost:8095"
    HOSTN_JELLYFIN_API_KEY=""   # Jellyfin Dashboard → Administration → API Keys

# ━━━ Gitea ━━━
# Personal access token for gitea_ssh_setup.sh.
# Create in Gitea: Settings → Applications → Generate Token → scope: write:user
    HOSTN_GITEA_API_TOKEN=""

# ━━━ Notifications ━━━
# Discord webhook — leave blank to disable.
    HOSTN_DISCORD_WEBHOOK=""

# ==============================================================================================
# ── PARTNERSHIP ───────────────────────────────────────────────────────────────────────────────
# ==============================================================================================

# Auth containers reconfigured on onboard/offboard.
# Format: "ContainerName|WebUIPort"
    HOSTN_PARTNERSHIP_AUTH_WEBUIS=(
        # "NginxProxyManager|81"
        # "Authelia|9091"
    )

# XML templates pushed to mirror during onboard — auth stack.
# Dependencies (databases) must come before apps that depend on them.
    HOSTN_PARTNERSHIP_AUTH_STACK=(
        # "my-Authelia.xml"
        # "my-NginxProxyManager.xml"
    )

# XML templates pushed to mirror during onboard — arr stack.
    HOSTN_PARTNERSHIP_ARR_STACK=(
        # "my-Sonarr.xml"
        # "my-Radarr.xml"
    )

# XML templates pushed to mirror during onboard — other services (not auth, not arr).
    HOSTN_PARTNERSHIP_SERVICES_STACK=(
        # "my-Lidarr.xml"
    )

# Paths the partner should collect during the grace window after offboard.
    HOSTN_PARTNERSHIP_MIRROR_BACKUPS=(
        # "/mnt/user/appdata-Fallback/Partner-Emby"
    )

# Containers parked on this server when partnership is active.
    HOSTN_PARTNERSHIP_OWN_CONTAINERS=(
        # "Emby"
    )

# Containers stopped on THIS server before deploying the mirror's stack on onboard.
    HOSTN_PARTNERSHIP_REPLACE_CONTAINERS=(
    )

# Arr containers stopped on this server when mirror's arr stack is deployed.
    HOSTN_PARTNERSHIP_ARR_REPLACE_CONTAINERS=(
    )

# Emby admin provisioning — owner controls whether Emby is shared.
    HOSTN_PARTNERSHIP_PROVISION_EMBY_ADMIN=false
    HOSTN_PARTNERSHIP_EMBY_PORT=8096
    HOSTN_PARTNERSHIP_EMBY_ADMIN_USER=""
    HOSTN_PARTNERSHIP_EMBY_ADMIN_PASS=""

# ==============================================================================================
# ── RSYNC ─────────────────────────────────────────────────────────────────────────────────────
# ==============================================================================================

# ━━━ Daily Sync Shares ━━━
# Media shares this host pushes to all other nodes every night.
# Uses DEFAULT_RSYNC_OPTS from master.conf — no profile needed.
    HOSTN_DAILY_SYNC_SHARES=(
        # /mnt/user/Movies
        # /mnt/user/Tv_Shows
        # /mnt/user/Music
    )

# ━━━ Personal Shares ━━━
# Private encrypted shares synced for offsite backup, independent of media shares.
    HOSTN_PERSONAL_SHARES=(
        # /mnt/user/Personal     # e.g. ZFS-encrypted dataset
    )

# ━━━ Weekly Sync Shares ━━━
# Appdata shares synced during the weekly maintenance window.
# Profiles (emby, critical-data) drive container stops — define in master.conf.
    HOSTN_WEEKLY_SYNC_SHARES=(
        # "/mnt/user/Media_Server/Emby"              # emby profile
        # "/mnt/user/appdata-Fallback/Critical-Data" # critical-data profile
    )

# ━━━ Monthly Sync Shares ━━━
# Shares synced by monthly_maintenance.sh. Add here when ready.
    HOSTN_MONTHLY_SYNC_SHARES=(
        # Add shares here
    )

# ━━━ Intermediate Sync Shares ━━━
# Shares synced every 4 hours. Leave empty to skip mid-day rsync.
    HOSTN_INTERMEDIATE_SYNC_SHARES=(
        # Add shares here to enable mid-day rsync
    )

# ━━━ Critical Sync Shares ━━━
# Appdata shares synced every 30 minutes.
# Format: "/path/to/share" or "/path/to/share|profile-name"
    HOSTN_CRITICAL_SYNC_SHARES=(
        # "/mnt/user/appdata-Fallback/Critical-Data|critical-fallback"
    )

# ━━━ Backup Verify ━━━
# Leave empty to use HOSTN_DAILY_SYNC_SHARES automatically.
    HOSTN_BACKUP_VERIFY_SHARES=(
        # leave empty to use HOSTN_DAILY_SYNC_SHARES automatically
    )

# ━━━ HOSTN Rsync Profile — hostn-appdata ━━━
# Host-specific appdata sync profile.
    # Retry/sleep/container-delay omitted — this profile uses the master.conf defaults for all three.
    PROFILE_RSYNC_OPTS[hostn-appdata]="-av --info=progress2 --bwlimit=${PROFILE_BW_LIMIT[hostn-appdata]:-8000}"
    PROFILE_BW_LIMIT[hostn-appdata]=8000
    PROFILE_CRITICAL_CONTAINER_NAMES[hostn-appdata]=""
    PROFILE_DELAYED_CONTAINERS[hostn-appdata]=""
    PROFILE_EXCLUDE_DIRS[hostn-appdata]="logs *.tmp"

# ==============================================================================================
# ── FALLBACK ──────────────────────────────────────────────────────────────────────────────────
# ==============================================================================================

# ━━━ DDNS ━━━
# DDNS containers this host manages.
    HOSTN_DDNS_CONTAINERS=(
        # "MyServer.com"
    )

# ━━━ Internet Loss ━━━
# Containers stopped immediately when internet is lost.
    FALLBACK_HOSTN_STOP_ON_NO_NET=(
        # "MyServer.com"
    )

# ━━━ Fallback Tiers — What HOSTN Wants Covered When Down ━━━
# Containers the partner starts for HOSTN when HOSTN goes down.
# Tier 1 is always immediate. Higher tiers activate after HOSTN_TIER*_DELAY minutes.
    FALLBACK_HOSTN_TIER1=(
        # "MyServer-DDNS-Container"
    )

    FALLBACK_HOSTN_TIER2=(
        # "container-placeholder"
    )

    FALLBACK_HOSTN_TIER3=(
        # "container-placeholder"
    )

    FALLBACK_HOSTN_TIER4=(
        # "container-placeholder"
    )

# ━━━ Tier Delays — HOSTN Outage Timers ━━━
# How long HOSTN must be down before each tier activates on the partner.
    HOSTN_TIER2_DELAY=240           # 4 hours
    HOSTN_TIER3_DELAY=720           # 12 hours
    HOSTN_TIER4_DELAY=1440          # 24 hours

# ━━━ Rsync Writeback ━━━
    HOSTN_TIER1_WRITEBACK_DELAY=60      # minimum outage minutes before Tier 1 writeback runs

    FALLBACK_HOSTN_WRITEBACK_TIER1=(
        # "/mnt/user/Media_Server/Emby"
    )

    FALLBACK_HOSTN_WRITEBACK_TIER2=(
        # "/mnt/user/appdata-Fallback/Important-Data"
    )

    FALLBACK_HOSTN_WRITEBACK_TIER3=(
        # "location-placeholder"
    )

    FALLBACK_HOSTN_WRITEBACK_TIER4=(
        # "/mnt/user/appdata-Fallback/Arrs_Stack"
    )

# ==============================================================================================
# ── DOCKER ────────────────────────────────────────────────────────────────────────────────────
# ==============================================================================================

# ━━━ Docker Daily Restart ━━━
    HOSTN_DAILY_RESTART_CONTAINERS=(
        # "NginxProxyManager"
        # "Authelia"
    )

# ━━━ Docker Weekly Restart ━━━
    HOSTN_WEEKLY_RESTART_CONTAINERS=(
        # "NextCloud"
        # "AdGuard-Home"
    )

# ━━━ Docker Watchdog ━━━

# Memory hard limits in MB — immediate restart if exceeded.
# 20GB=20480  16GB=16384  8GB=8192  4GB=4096  2GB=2048  1GB=1024
    declare -A HOSTN_WATCHDOG_CONTAINERS=(
        # ["Emby"]=18432
    )

# HTTP health check URLs — checked every cycle.
    declare -A HOSTN_WATCHDOG_CONTAINER_URLS=(
        # ["Emby"]="http://localhost:8096"
        # ["Jellyfin"]="http://localhost:8095"
        # ["NginxProxyManager"]="http://localhost:7818"
        # ["Authelia"]="http://localhost:9091/api/health"
        # ["Authelia-Secondary"]="http://localhost:9092/api/health"
        # ["Lldap"]="http://localhost:17170"
    )

# API-level health checks — catches HTTP-200-but-internally-frozen containers (DB lock,
# deadlocked thread, etc.) that a basic HTTP check above would miss. Pick an endpoint that
# forces a real DB round-trip — a lightweight status endpoint may stay 200 even while the
# rest of the app is locked up. Format: ["ContainerName"]="url|APIKey"
    declare -A HOSTN_WATCHDOG_CONTAINER_API_CHECKS=(
        # ["Emby"]="${HOSTN_EMBY_URL}/Users|${HOSTN_EMBY_API_KEY}"
        # ["Jellyfin"]="${HOSTN_JELLYFIN_URL}/Users|${HOSTN_JELLYFIN_API_KEY}"
    )

# Required containers — must always be running.
    HOSTN_WATCHDOG_REQUIRED_CONTAINERS=(
        # "NginxProxyManager"
        # "Authelia"
    )

# Containers to skip in Tier 2 global scan.
    HOSTN_WATCHDOG_SCAN_IGNORE=(
        # "my-occasional-container"
    )

# Dependency ordering — skip restarting a container if its dependency is also down.
    declare -A HOSTN_WATCHDOG_DEPENDENCIES=(
        # ["Authelia"]="Mariadb Redis-Authelia"
    )

# Per-container appdata growth suppress ceilings in MB.
    declare -A HOSTN_WATCHDOG_APPDATA_SIZES=(
        # ["Tdarr"]="25600"
    )

# ━━━ Network Watchdog ━━━
    HOSTN_NETWORK_WATCHDOG_DDNS_DOMAIN=""       # e.g. myserver.com
    HOSTN_NETWORK_WATCHDOG_DDNS_CONTAINER=""    # e.g. MyServer.com
    HOSTN_NETWORK_WATCHDOG_NPM_URL=""           # e.g. https://myserver.com

# ━━━ Docker Network Connect ━━━
    HOSTN_NETWORK_CONNECT_CONTAINERS=(
        # "memcached"
    )

    HOSTN_NETWORK_CONNECT_NETWORKS=(
        # "high-availability"
    )

# ==============================================================================================
# ── MEDIA ─────────────────────────────────────────────────────────────────────────────────────
# ==============================================================================================

# ━━━ Media Permissions ━━━
    HOSTN_MEDIA_PERMISSION_SHARES=(
        # /mnt/user/Movies
        # /mnt/user/Tv_Shows
        # /mnt/user/Music
        # /mnt/user/Downloads
    )

# ━━━ Media Cleaner ━━━
    HOSTN_ANIME_CLEAN_FOLDERS=(
        # /mnt/user/Anime_Movies
        # /mnt/user/Anime_Shows
    )

    HOSTN_MEDIA_CLEAN_FOLDERS=(
        # /mnt/user/Movies
        # /mnt/user/Tv_Shows
    )

# ==============================================================================================
# ── ARR STACK ─────────────────────────────────────────────────────────────────────────────────
# ==============================================================================================

# ━━━ Downloaders ━━━
    HOSTN_SLSKD_URL="http://localhost:8980"
    HOSTN_SLSKD_API_KEY=""
    HOSTN_SLSKD_FAILED_IMPORTS_DIR=""

    HOSTN_SABNZBD_URL="http://localhost:8180"
    HOSTN_SABNZBD_API_KEY=""

    HOSTN_QBIT_URL="http://localhost:8080"
    HOSTN_QBIT_USERNAME="admin"
    HOSTN_QBIT_PASSWORD=""

# ━━━ Lidarr ━━━
    HOSTN_LIDARR_URL="http://localhost:8686"
    HOSTN_LIDARR_API_KEY=""
    HOSTN_LIDARR_MUSIC_ROOT="/mnt/user/Music"
    HOSTN_FANART_API_KEY=""
    HOSTN_LASTFM_API_KEY=""

    declare -A HOSTN_LIDARR_PATH_MAP=(
        # ["/music"]="/mnt/user/Music"
    )

# ━━━ Sonarr ━━━
    HOSTN_SONARR_URL="http://localhost:8989"
    HOSTN_SONARR_API_KEY=""
    HOSTN_SONARR_TV_ROOT="/mnt/user/Tv_Shows"
    HOSTN_SONARR_GENERAL_ROOT=""  # rootFolderPath literal for the general root (e.g. "/tv") — target for reverse-kids-leak moves; leave blank to disable
    HOSTN_SONARR_KIDS_ROOT=""    # rootFolderPath literal, as reported by Sonarr API — leave blank if no dedicated kids root
    HOSTN_SONARR_ANIME_ROOT=""   # rootFolderPath literal, as reported by Sonarr API — leave blank if no dedicated anime root
    HOSTN_SONARR_DOWNLOAD_DIR=""            # host path of the completed-downloads folder Sonarr imports from (e.g. "/mnt/cache/Temp_Storage/SABnzbd/Completed/Tv Shows") — blank disables the download orphan cleaner for Sonarr
    HOSTN_SONARR_DOWNLOAD_CONTAINER_DIR=""  # same folder as Sonarr's container sees it (e.g. "/downloads/Completed/Tv Shows") — needed to trigger import scans on held folders

    declare -A HOSTN_SONARR_PATH_MAP=(
        # ["/tv"]="/mnt/user/Tv_Shows"
    )

# ━━━ Radarr ━━━
    HOSTN_RADARR_URL="http://localhost:7878"
    HOSTN_RADARR_API_KEY=""
    HOSTN_TMDB_API_KEY=""
    HOSTN_RADARR_MOVIES_ROOT="/mnt/user/Movies"
    HOSTN_RADARR_GENERAL_ROOT=""  # rootFolderPath literal for the general root (e.g. "/movies") — target for reverse-kids-leak moves; leave blank to disable
    HOSTN_RADARR_KIDS_ROOT=""    # rootFolderPath literal, as reported by Radarr API — leave blank if no dedicated kids root
    HOSTN_RADARR_ANIME_ROOT=""   # rootFolderPath literal, as reported by Radarr API — leave blank if no dedicated anime root
    HOSTN_RADARR_DOWNLOAD_DIR=""            # host path of the completed-downloads folder Radarr imports from (e.g. "/mnt/cache/Temp_Storage/SABnzbd/Completed/Movies") — blank disables the download orphan cleaner for Radarr
    HOSTN_RADARR_DOWNLOAD_CONTAINER_DIR=""  # same folder as Radarr's container sees it (e.g. "/downloads/Completed/Movies") — needed to trigger import scans on held folders

    declare -A HOSTN_RADARR_PATH_MAP=(
        # ["/movies"]="/mnt/user/Movies"
    )

# ━━━ Corruption Scan ━━━
    # Container that has a working ffprobe binary AND mounts the same shares as the arrs'
    # roots — check `docker inspect <container>` for its mounts before filling this in.
    HOSTN_FFPROBE_CONTAINER=""
    HOSTN_FFPROBE_BIN=""

    declare -A HOSTN_FFPROBE_PATH_MAP=(
        # ["/mnt/user/Tv_Shows"]="/ext-tv-shows"
        # ["/mnt/user/Movies"]="/ext-movies"
        # Prefixes should match what Sonarr/Radarr actually track (HOSTN_SONARR_PATH_MAP /
        # HOSTN_RADARR_PATH_MAP) — extend coverage here as more shares get mounted into the
        # ffprobe container, e.g.:
        # ["/mnt/user/Kids_Tv_Shows"]="/ext-kids-tv"
        # ["/mnt/user/Kids_Movies"]="/ext-kids-movies"
        # ["/mnt/user/Anime_Shows"]="/ext-anime-shows"
        # ["/mnt/user/Anime_Movies"]="/ext-anime-movies"
        # ["/mnt/user/stand-up_comedy"]="/ext-standup"
    )

# ━━━ Arr Recovery Toggles ━━━
    HOSTN_LIDARR_RECOVERY=false
    HOSTN_SONARR_RECOVERY=true
    HOSTN_RADARR_RECOVERY=true

# ==============================================================================================
# ── TRANSCODES ────────────────────────────────────────────────────────────────────────────────
# ==============================================================================================

    HOSTN_RAMDISK_SIZE="10G"
    HOSTN_RAMDISK_WARN_GB=8.5
    HOSTN_RAMDISK_LOW_GB=7
    HOSTN_TRANSCODE_SSD="/mnt/cache/Temp_Storage/Emby/Transcodes/"

    HOSTN_TRANSCODE_SERVERS=(
        "${HOSTN_EMBY_CONTAINER}|${HOSTN_EMBY_URL}|${HOSTN_EMBY_API_KEY}|emby"
        "${HOSTN_JELLYFIN_CONTAINER}|${HOSTN_JELLYFIN_URL}|${HOSTN_JELLYFIN_API_KEY}|jellyfin"
    )

# ==============================================================================================
# ── MONITORS ──────────────────────────────────────────────────────────────────────────────────
# ==============================================================================================

# ━━━ Certificate Monitor ━━━
    HOSTN_CERT_MONITOR_DOMAINS=(
        # "myserver.com"
    )

# ━━━ SMART Health ━━━
    HOSTN_SMART_IGNORE_DRIVES=(
        "sda"   # boot USB — SMART not meaningful on flash drives
    )

# ━━━ ZFS Report ━━━
    HOSTN_ZFS_REPORT_IGNORE_POOLS=(
        # "disk5"
    )

# ==============================================================================================
# ── RESOURCE MANAGER ──────────────────────────────────────────────────────────────────────────
# ==============================================================================================

    HOSTN_RW_PAUSE_CONTAINERS=(
        # "Tdarr"
        # "LidaTube"
    )

    HOSTN_RW_STOP_CONTAINERS=(
        # "Tdarr"
    )

# ==============================================================================================
# ── SYSTEM WATCHDOG ───────────────────────────────────────────────────────────────────────────
# ==============================================================================================

    HOSTN_SYS_WATCHDOG_NIC=""   # e.g. eth0 — for network monitoring

    HOSTN_SYS_WATCHDOG_CHECK_DOCKER_DAEMON=true
    HOSTN_SYS_WATCHDOG_CHECK_ROOTFS=true
    HOSTN_SYS_WATCHDOG_CHECK_KERNEL_OOPS=true
    HOSTN_SYS_WATCHDOG_CHECK_FD=true
    HOSTN_SYS_WATCHDOG_CHECK_BOOT=true
    HOSTN_SYS_WATCHDOG_CHECK_OOM=true
    HOSTN_SYS_WATCHDOG_CHECK_RAM=true
    HOSTN_SYS_WATCHDOG_CHECK_LOG=true
    HOSTN_SYS_WATCHDOG_CHECK_ARC=true
    HOSTN_SYS_WATCHDOG_CHECK_CPU_TEMP=true
    HOSTN_SYS_WATCHDOG_CHECK_LOAD=true
    HOSTN_SYS_WATCHDOG_CHECK_ZOMBIES=true
    HOSTN_SYS_WATCHDOG_CHECK_CONTAINERS=true
    HOSTN_SYS_WATCHDOG_CHECK_TMP=true
    HOSTN_SYS_WATCHDOG_CHECK_MDSTAT=true
    HOSTN_SYS_WATCHDOG_CHECK_NETWORK=true
    HOSTN_SYS_WATCHDOG_CHECK_SSHD=true
    HOSTN_SYS_WATCHDOG_CHECK_RUNAWAY=false

# ==============================================================================================
# ── AUTH STACK ────────────────────────────────────────────────────────────────────────────────
# ==============================================================================================
# Credentials for the Varaverk Auth Stack page (NPM, lldap, Authelia).

# ━━━ NginxProxyManager ━━━
# Admin API runs on 7818 (not 81 — 81 is the partnership WebUI port).
    HOSTN_NPM_URL="http://localhost:7818"
    HOSTN_NPM_USER=""                           # NPM admin email
    HOSTN_NPM_PASS=""                           # NPM admin password

# ━━━ lldap ━━━
    HOSTN_LLDAP_URL="http://localhost:17170"
    HOSTN_LLDAP_USER="admin"                    # lldap admin username
    HOSTN_LLDAP_PASS=""                         # lldap admin password


# ==============================================================================================
# ── Ollama / AI ───────────────────────────────────────────────────────────────────────────────
# ==============================================================================================
# Per-host because only some nodes actually have a GPU. A node with an empty OLLAMA_URL is not
# an error — it falls through to the resolver and uses another node's Ollama over Tailscale.

# ━━━ Ollama ━━━
    HOSTN_OLLAMA_URL=""                          # e.g. http://localhost:11434 — empty if no local Ollama
    HOSTN_OLLAMA_GPU_UUID=""                     # pins Ollama to one card on multi-GPU hosts
    HOSTN_OLLAMA_MODEL="hf.co/unsloth/Qwen3-14B-GGUF:IQ4_XS"  # generation — must fully offload; see README-AI.md

# ━━━ Web search ━━━
# Per-host because one is an address on this network and the other is a credential. Only the
# General Chat profile can use these — it is the profile that cannot change anything, which is
# why it is the one allowed to look outside. Off until AI_WEB_SEARCH_ENABLED says otherwise.
    HOSTN_SEARXNG_URL=""                         # e.g. http://localhost:8888 — needs format: [json] in its settings.yml
    HOSTN_WEB_SEARCH_API_KEY=""                  # brave or tavily; unused when the provider is searxng
    HOSTN_OLLAMA_EMBED_MODEL="nomic-embed-text"  # embeddings — the generation model cannot embed

# ━━━ Authelia ━━━
    HOSTN_AUTHELIA_CONFIG="/mnt/user/appdata-Fallback/Critical-Data/Authelia/configuration.yml"
    HOSTN_AUTHELIA_CONTAINER="Authelia"

# ==============================================================================================
# ──────────────────────── End Of HOSTn Variables ──────────────────────────────────────────────
# ==============================================================================================