# ==========================================
# susshi - Example configuration
# ==========================================

# ─── VARIABLE TEMPLATING (optional) ────────────────────────────────────────
# Define reusable scalar variables in an `_vars` top-level section and
# reference them with {{ var_name }} in any string field of the same file
# (host, user, ssh_key, name, …).
#
# Rules:
#   - Scope is FILE-LOCAL — variables in an included file do not propagate to
#     the parent file, and vice versa.
#   - Only scalar string values are supported (no lists, no nested maps).
#   - A reference to an undefined variable leaves the {{ placeholder }} intact
#     and emits a non-blocking warning at startup.
#
# ── Built-in variable: {{ index }} ──────────────────────────────────────────
# {{ index }} is a special variable automatically set to the 1-based position
# of a server inside its parent list. It lets you declare a whole fleet of
# similarly named servers as a compact block without copy-pasting:
#
# _vars:
#   bastion: "bastion.prod.example.com"
#   prod_key: "~/.ssh/prod_ed25519"
#   subnet: "198.51.100"
#
# groups:
#   - name: "Workers"
#     environments:
#       - name: "prod"
#         defaults:
#           jump:
#             - host: "{{ bastion }}"
#               user: "jump"
#           ssh_key: "{{ prod_key }}"
#           mode: jump
#         servers:
#           - name: "worker-{{ index }}"   # → worker-1, worker-2, worker-3 …
#             host: "{{ subnet }}.{{ index }}"  # → 198.51.100.1, 198.51.100.2 …
#           - name: "worker-{{ index }}"
#             host: "{{ subnet }}.{{ index }}"
#           - name: "worker-{{ index }}"
#             host: "{{ subnet }}.{{ index }}"
#   # Result: worker-1 @ 198.51.100.1, worker-2 @ 198.51.100.2, worker-3 @ 198.51.100.3
#
# Note: {{ index }} is resolved independently per list — if two environments
# both contain servers using {{ index }}, each list starts at 1.

# ─── MULTI-FILE (optional) ──────────────────────────────────────────────────
# Split your configuration across multiple files by team or perimeter.
# Each included file appears in the TUI as a collapsible namespace (📦).
#
# includes:
#   - label: "DEV"                  # Label shown in the TUI
#     path: "~/.susshi_dev.yml"      # Absolute path or ~ expansion
#   - label: "QUALITY ASSURANCE"
#     path: "~/.susshi_quality.yml"
#     merge_defaults : true           # Optional, default: false. If true, the `defaults` section of the included file is merged with the parent defaults instead of replacing them.
#
# Rules:
#   - `defaults` from an included file are local to that file.
#   - Nested includes (includes inside a sub-file) are resolved recursively.
#   - A missing or circular include produces a non-blocking warning.

# 1. Default settings (Global level)
# These values are used unless overridden at a lower level.
defaults:
  user: "ops-user"
  ssh_key: "~/.ssh/id_ed25519"
  ssh_port: 22
  ssh_options:
    - "StrictHostKeyChecking=no"
    - "UserKnownHostsFile=/dev/null"
  # Set to true to use the SSH config file (~/.ssh/config) for resolving hosts, users, ports, and options.
  use_system_ssh_config: false
  # Catppuccin theme: latte | frappe | macchiato | mocha (default)
  theme: mocha
  # Set to true to reopen the TUI automatically after a connection closes
  keep_open: false
  # Pre-apply a search filter when the TUI starts. The user can clear it with Esc.
  # Supports the same syntax as the live search bar: text, #tag, or a mix.
  # default_filter: "#prod"
  wallix:
    host: "bastion.example.com"
    user: "bastion-user"
    # Canonical Wallix group key (legacy wallix_group is still accepted).
    # A short value is allowed: menu entries like PREFIX_devops-admins will match.
    group: "devops-admins"
    account: "default"
    protocol: "SSH"
    auto_select: true
    fail_if_menu_match_error: true
    selection_timeout_secs: 8
    # Set to true when the target server always connects directly through Wallix
    # without presenting a selection menu. Skips the menu probe and connects
    # instantly — eliminates the ~5 s delay for direct-checkout targets.
    # direct: true
    # Exact Wallix authorization name (e.g. "STI-ANSCORE_ces3s-admins").
    # When set, takes priority over `group` and is passed verbatim in the login
    # string. Use with direct: true for instant zero-delay connections.
    # authorization: "PREFIX_group-name"
  # Single jump host
  jump:
    - host: "jump.example.com"
      user: "jump-user"
  # Multi-hop example (two successive hops):
  # jump:
  #   - host: "jump1.example.com"
  #     user: "jump-user"
  #   - host: "jump2.example.com"
  #     user: "jump-user"

  # Extra mount points to inspect during the quick diagnostic (`d`).
  # Semantics: ADDITIVE — each level APPENDS its paths to the parent list
  # (unlike user/ssh_key which replace the parent value).
  # If a filesystem is not mounted on the server, a ⚠ warning is shown
  # instead of a progress bar.
  probe_filesystems:
    - "/var/log"
    - "/data"

  # ─── SSH CONTROLMASTER (optional) ──────────────────────────────────────────
  # Reuse SSH connections for the same host — subsequent connections are
  # nearly instantaneous. Not supported in wallix mode.
  # susshi automatically creates the parent directory of the socket path.
  #
  # control_master: true
  # control_path: "~/.ssh/ctl/%h_%p_%r"   # default socket location
  # control_persist: "10m"                # keep master alive 10 min after disconnect

  # ─── HOOKS (optional) ──────────────────────────────────────────────────────
  # Shell scripts executed before / after each SSH connection.
  # Environment variables available inside the hook:
  #   SUSSHI_SERVER  — server name as declared in the config
  #   SUSSHI_HOST    — resolved hostname / IP
  #   SUSSHI_USER    — SSH user
  #   SUSSHI_PORT    — SSH port
  #   SUSSHI_MODE    — connection mode (direct | jump | wallix)
  # A non-zero exit code from pre_connect_hook cancels the connection.
  # hook_timeout_secs prevents blocking on slow hooks (default: 5).
  #
  # pre_connect_hook: "~/.config/susshi/hooks/pre_connect.sh"
  # post_disconnect_hook: "~/.config/susshi/hooks/post_disconnect.sh"
  # hook_timeout_secs: 5

  # ─── SSH TUNNELS (optional) ───────────────────────────────────────────────
  # Pre-configured SSH local-port-forwarding tunnels for a server.
  # Press `T` in the TUI to open the tunnel manager and start/stop each tunnel.
  #
  # Semantics: REPLACE — a tunnels list defined at a lower level (group,
  # environment, server) fully replaces the one inherited from above.
  #
  # Restriction: tunnels are NOT available in `wallix` mode (the bastion
  # does not allow arbitrary port forwarding).
  #
  # Each entry produces: ssh -L local_port:remote_host:remote_port -N ...
  #
  # tunnels:
  #   - local_port: 5432        # Port bound on localhost
  #     remote_host: 127.0.0.1  # Host as seen from the remote server
  #     remote_port: 5432       # Port on the remote side
  #     label: "PostgreSQL"     # Optional — shown in the TUI tunnel list

groups:
  # --- LEVEL 3 example: Group → Environment → Server ---
  - name: "Projet Alpha"
    user: "app-user" # Override the default user for the whole group
    # Appends /app_data to the filesystems defined in defaults (/var/log, /data).
    # A server in this group with mode: direct will monitor /var/log, /data AND /app_data.
    probe_filesystems:
      - "/app_data"
    environments:
      - name: "Production"
        servers:
          - name: "nextcloud"
            user: "service-admin"
            host: "198.51.100.13"
            mode: "direct" # Standard SSH connection
            # Free-form description shown in the server detail panel (TUI).
            notes: "Primary Nextcloud instance. Admin panel: https://198.51.100.13/admin"
            # Tags are optional string labels used for filtering in the TUI (/)
            # and in --export-filter. Support text + #tag syntax.
            tags: [prod, eu-west, web]
            # Use a dedicated SSH agent socket for this server (Unix only).
            # Overrides the SSH_AUTH_SOCK environment variable and passes
            # -o IdentityAgent=... to ssh. Useful for GPG-based or per-server agents.
            # ssh_agent_sock: "/run/user/1000/gnupg/S.gpg-agent.ssh"
          - name: "db-01"
            host: "198.51.100.11"
            notes: "PostgreSQL primary — replica is db-02 (198.51.100.12)"
            # Appends /pg_data at server level: monitors /var/log, /data, /app_data AND /pg_data.
            probe_filesystems:
              - "/pg_data"
            # SSH tunnels — press `T` in the TUI to start/stop them individually.
            # Not available in wallix mode.
            tunnels:
              - local_port: 5432
                remote_host: 127.0.0.1
                remote_port: 5432
                label: "PostgreSQL"
              - local_port: 6379
                remote_host: 127.0.0.1
                remote_port: 6379
                label: "Redis"
      - name: "Staging"
        servers:
          - name: "web-stg"
            host: "198.51.100.20"
            mode: "jump" # Route through a jump host
  # --- LEVEL 2 example: Group → Server ---
  - name: "Secured Perimeter"
    wallix:
      # Group applied by default to servers in this group.
      group: "ops-admins"
    servers:
      - name: "anscore-admin"
        host: "anscore-admin.internal.example"
        mode: "wallix"
        wallix:
          # Server-level override has priority over inherited group.
          group: "qa-admin"
      - name: "standard-ops"
        host: "standard-ops.internal.example"
        mode: "wallix"
        # Inherits wallix.group = "ops-admins" from parent group.
      - name: "anscore02"
        host: "anscore02.internal.example"
        mode: "wallix"
        wallix:
          # Exact authorization name pins the right entry when multiple groups exist.
          # Combined with direct: true → instant connection, no menu probe.
          authorization: "STI-ANSCORE_ces3s-admins"
          direct: true

  - name: "Infrastructure"
    servers:
      - name: "proxmox-host"
        host: "198.51.100.100"
        mode: "direct"
      - name: "internal-nas"
        host: "198.51.100.200"
        user: "nas-admin"
        mode: "wallix" # Route through a dedicated Wallix bastion
  # --- LEVEL 1 example: Single server at root ---
  - name: "Raspberry-Pi-Home"
    host: "home-lab.localdomain"
    user: "home-user"
    mode: "direct"
      