veza/infra/ansible/roles/veza_app/defaults/main.yml

# veza_app role defaults — the small set of knobs every component
# inherits unless overridden in group_vars/<env>.yml or vars/<component>.yml.
#
# Inputs ARE expected from the caller (see README.md for the required
# list); these defaults only cover values that ARE NOT environment-
# specific (paths, file modes, retry counts).
---
# These should be set by the caller — defaulting to false so a
# misconfigured invocation fails loud instead of silently picking
# `backend`.
veza_component: ""
veza_target_color: ""
veza_release_sha: ""

# Paths in-container. Per-SHA install dir keeps multiple releases
# coexistent for forensics: a failed deploy leaves the previous tree
# on disk, recoverable via `incus exec ... -- ls /opt/veza/<component>/`.
veza_app_install_dir: "{{ veza_install_root }}/{{ veza_component }}"
veza_app_release_dir: "{{ veza_app_install_dir }}/{{ veza_release_sha }}"
veza_app_current_link: "{{ veza_app_install_dir }}/current"

# System user that owns the install dir + runs the systemd service.
# Per-component user prevents cross-process file leaks on a shared host.
veza_app_user: "veza-{{ veza_component }}"
veza_app_group: "veza-{{ veza_component }}"

# Mode bits used consistently across templates.
veza_app_dir_mode: "0750"
veza_app_file_mode: "0640"
veza_app_secret_mode: "0400"
veza_app_binary_mode: "0755"

# Container container, derived from inputs. Built once here so every
# task references the same name without re-deriving.
veza_app_container_name: "{{ veza_container_prefix }}{{ veza_component }}-{{ veza_target_color }}"

# URL to fetch the release tarball. Computed once per task chain.
# `veza-<component>` is the Forgejo package name (one package per
# component) ; SHA is the version ; tarball is the filename.
veza_app_artifact_url: "{{ veza_artifact_base_url }}/veza-{{ veza_component }}/{{ veza_release_sha }}/veza-{{ veza_component }}-{{ veza_release_sha }}.tar.zst"

# How long to wait for the container's network namespace to come up
# after `incus launch` before we start running tasks against it.
# Debian 13 with a small profile is ready in ~3-5s; 30s is a safety net.
veza_app_container_ready_timeout: 30