---
# ---------------------------------------------------------------------------
mysql_root_password: "{{ lookup('env', 'MYSQL_ROOT_PASSWORD') | default('', true) }}"
mysql_replication_user: "repl"
mysql_replication_password: "{{ lookup('env', 'MYSQL_REPL_PASSWORD') | default('', true) }}"
mysql_app_user: "{{ lookup('env', 'MYSQL_APP_USER') | default('appuser', true) }}"
mysql_app_password: "{{ lookup('env', 'MYSQL_APP_PASSWORD') | default('', true) }}"
mysql_app_database: "{{ lookup('env', 'MYSQL_APP_DATABASE') | default('appdb', true) }}"

mysql_version: "{{ lookup('env', 'MYSQL_VERSION') | default('8.0', true) }}"
mysql_server_id: "{{ lookup('env', 'HOSTNAME') | default('mysql', true) }}"

# --- Sizing ------------------------------------------------------------
# Set per-environment (override in host_vars if primary/replicas differ in size).
# Rule of thumb: innodb_buffer_pool_size ~= 70-75% of RAM on a dedicated DB host.
mysql_total_ram_mb: "{{ lookup('env', 'MYSQL_TOTAL_RAM_MB') | default(8192, true) | int }}"
mysql_innodb_buffer_pool_size: "{{ (mysql_total_ram_mb | int * 0.70) | round | int }}M"

mysql_max_connections: 200

# --- Networking / security ----------------------------------------------
mysql_bind_address: "0.0.0.0"     # bound to all interfaces; ufw restricts who can reach it
mysql_port: 3306
mysql_allowed_cidrs:              # who is allowed to hit port 3306 via firewall
  - "{{ lookup('env', 'MYSQL_ALLOWED_CIDR') | default('10.0.1.0/24', true) }}"

# --- Replication ----------------------------------------------------------
mysql_gtid_mode: "ON"
mysql_binlog_format: "ROW"
mysql_binlog_expire_logs_seconds: 604800   # 7 days

# --- Backups ---------------------------------------------------------------
mysql_backup_enabled: "{{ lookup('env', 'MYSQL_BACKUP_ENABLED') | default('true', true) | bool }}"
mysql_backup_dir: /var/backups/mysql
mysql_backup_retention_days: 7
mysql_backup_hour: 2    # 2am local, staggered per-host below if needed