# /etc/thermograph-topology.env — RENDERED BY TERRAFORM. Do not edit on the host;
# change the tfvars and re-apply. Non-secret sizing/routing config ONLY; every app
# secret (POSTGRES_PASSWORD, THERMOGRAPH_AUTH_SECRET, VAPID keys, REGISTRY_TOKEN,
# Discord/SMTP creds, ...) lives in /etc/thermograph.env instead, rendered at deploy
# time from the SOPS+age vault by deploy/render-secrets.sh (see deploy.sh). Both
# files are sourced before `docker compose` runs — this one first, so a same-named
# vault value (there shouldn't be one) would still win.

# Port uvicorn binds inside the container (compose publishes it on the host).
PORT=${app_port}

# --- Container sizing (consumed by docker-compose.yml interpolation) -------------
# Terraform sizes the containers per host. Defaults in compose are 4 / 4 / 2 / 8g.
WORKERS=${workers}
APP_CPUS=${app_cpus}
DB_CPUS=${db_cpus}
DB_MEMORY=${db_memory}
# "latest-pg18" (the default) matches today's behavior. Pin an exact minor before
# any host of this stack could ever replicate with another (docker-compose.yml).
TIMESCALEDB_TAG=${timescaledb_tag}
%{ if openmeteo ~}

# --- Self-hosted Open-Meteo archive (docker-compose.openmeteo.yml) ---------------
# Host rclone mount of the ERA5 object-storage bucket; the overlay bind-mounts it
# into the Open-Meteo containers. THERMOGRAPH_ARCHIVE_URL is set by the overlay.
OM_DATA_DIR=${om_data_dir}
%{ endif ~}

# --- Serving --------------------------------------------------------------------
THERMOGRAPH_BASE=${base}
THERMOGRAPH_BASE_URL=${base_url}
# Secure cookie is only sent over HTTPS: 1 behind Caddy TLS, 0 on a plain-HTTP host.
THERMOGRAPH_COOKIE_SECURE=${cookie_secure}