topology:
  mesh: tailscale
  git_provider: forgejo

deployment:
  mode: pull
  orchestrator: saturn

# Ingress dla usług domowych przez NPM @ PIHA + wildcard cert kapala.org.
# Od 2026-06-30. Poprzednia ścieżka (add-on Tailscale na ha-ken) PORZUCONA.
# DNS kapala.org: Cloudflare, wildcard *.kapala.org via DNS-01 (auto-renew).
# Mail: Fastmail (MX/DKIM/SPF na CF, DNS only).
# Subdomeny mesh: A → 100.108.208.3 (Tailscale PIHA), DNS only.
ingress:
  dns_provider: cloudflare          # kapala.org od 2026-06-30
  wildcard_cert:
    domain: "*.kapala.org"
    method: dns-01                  # Cloudflare DNS-01, auto-renew
    proxy: npm-piha                 # Nginx Proxy Manager @ PIHA
  services:
    home_assistant:
      host: 192.168.31.7
      port: 8123
      ingress: ha.kapala.org        # NPM @ PIHA, cert *.kapala.org, mesh-only
      access: tailscale             # 100.108.208.3
      cert: wildcard-kapala         # DNS-01 Cloudflare, auto-renew
    immich:
      host: 192.168.31.5
      port: 2283
      ingress: immich.kapala.org    # NPM @ PIHA, cert *.kapala.org, mesh-only
      access: tailscale
      cert: wildcard-kapala

nodes:

  saturn:
    roles:
      - control
      - development

  piha:
    roles:
      - infra
      - monitoring
    services:
      - node-agent
      - ha-diag-agent
      - brain-watchdog
      - vikunja             # Task management (vikunja + postgres), public via npm
      - kb-postgres         # KB spine: Postgres 16 + pgvector, port 5433 (always-on)
      - llm-gateway         # FastAPI router -> Ollama @ SOLARIA (Tailscale-internal :8080)

  solaria:
    roles:
      - compute
      - ai
    services:
      - node-agent

  vps:
    roles:
      - edge
      - ingress
      - control-plane
    services:
      # Repo-managed GitOps services (hosts/vps/services.yaml is authoritative)
      - node-agent
      - control-plane       # executor, observer, supervisor, operator-ui
      - node_exporter
      - fleet-prometheus    # Fleet liveness source of truth (Tailscale-internal)
      - stability-agent
      - npm                 # Nginx Proxy Manager — public ingress, TLS termination
      - outline             # Team wiki (outline + postgres + redis)
      - joplin              # Note sync server (joplin-server + postgres)
      - ai-cluster          # AI workers: codex-worker, openclaw, planner-worker,
                            # service-ops-worker, redis, mosquitto
      - gokapi              # Public file-share (Firefox Send alt), share.okit.pl via npm@VPS,
                            # local disk storage, E2E encryption ON — separate from private Nextcloud

  chelsty-infra:
    site: chelsty
    roles:
      - remote
      - hypervisor
      - infra
      - staging
    connectivity:
      uplink: lte
      intermittent: true
    home_automation:
      offline_operation_required: true
      services:
        - zigbee2mqtt
        - mosquitto
      coordinator:
        model: SLZB-06U
        connection: network
        usb: false

  chelsty-ha:
    site: chelsty
    roles:
      - remote
      - homeassistant
    connectivity:
      uplink: lte
      intermittent: true
    home_automation:
      offline_operation_required: true
      services:
        - homeassistant

  lustro:
    roles:
      - edge
    services:
      - node-agent