########################################
# Nextcloud
########################################

# Recommended to use the latest stable version.
nextcloud_version: "34.0.1"

# The domain name for your Nextcloud instance.
# If multiple domains/instances are setup, you will have to change the domain per server manually.
# The files that you will have to change are:
# - /etc/nextcloud/config/config.php
# - /etc/apache2/sites-available/nextcloud.conf
nextcloud_domain: "cloud.example.com"

# /etc/nextcloud is recommendet as the install dir by the hardening guide! Normally you can leave this as the default.
nextcloud_install_dir: "/etc/nextcloud"
nextcloud_data_dir: "/etc/nextcloud/data"

nc_db_name: "nextcloud"
nc_db_user: "nextcloud"
nc_db_password: "ChangeMe1234_"
nc_admin_user: "admin"
nc_admin_password: "ChangeMe1234_"

# It is recommended to check what the php requirements are for the Nextcloud version you want to install. The default is set to 8.5, which is the recommended version as of July 2026.
nc_php_version: "8.3"

# Nextcloud TLS certificate paths
nc_ssl_cert: "/etc/ssl/certs/nextcloud-selfsigned.crt"
nc_ssl_key:  "/etc/ssl/private/nextcloud-selfsigned.key"

# Nextcloud maintenance window (UTC): tasks run between start and start+4h
# 1 = 01:00 UTC → adjust to your timezone offset as needed
nc_maintenance_window_start: 1

# The fail2ban configuration directory. This is normally /etc/fail2ban, but can be changed if you have a custom setup.
fail2ban_dir: "/etc/fail2ban"

########################################
# Nextcloud Talk High Performance Backend (HPB)
########################################

nc_talk_hpb_domain: "talk-hpb.cloud.example.com"

# Where the NATS/Janus/Signaling Docker Compose stack and its config live on the HPB host.
nc_talk_hpb_install_dir: "/opt/hpb"

# Talk HPB TLS certificate paths (used by the Apache reverse proxy).
nc_talk_hpb_ssl_cert: "/etc/ssl/certs/nc-talk-hpb-selfsigned.crt"
nc_talk_hpb_ssl_key:  "/etc/ssl/private/nc-talk-hpb-selfsigned.key"

# UDP port range Janus uses for WebRTC media (RTP). Must also be reachable through the firewall.
nc_talk_hpb_rtp_port_range: "20000-40000"

# Admin key for the Janus VideoRoom plugin (lets the signaling server manage rooms via the admin API).
nc_talk_hpb_janus_admin_key: "ChangeMe1234_"

# Shared secrets for the signaling server. Generate each with the given command and paste the result here.
# turn/signaling/hash: openssl rand -hex 32   (64 hex chars)
# block:               openssl rand -hex 16   (32 hex chars — MUST be exactly 32, 48 or 64 hex chars or the signaling server refuses to start)
nc_talk_hpb_turn_secret: "ChangeMe_RunOpensslRandHex32"
nc_talk_hpb_signaling_secret: "ChangeMe_RunOpensslRandHex32"
nc_talk_hpb_hash_key: "ChangeMe_RunOpensslRandHex32"
nc_talk_hpb_block_key: "ChangeMe_RunOpensslRandHex16"

########################################
# Collabora CODE
########################################

# The domain of your Collabora CODE server.
collabora_code_domain: "office.example.com"

# The admin password for your Collabora CODE server.
collabora_admin_password: "ChangeMe1234_"

# Nextcloud TLS certificate paths
cc_ssl_cert: "/etc/ssl/certs/collabora-selfsigned.crt"
cc_ssl_key:  "/etc/ssl/private/collabora-selfsigned.key"