# Ansible 管理；与 k3s、数据库生命周期独立。
name: {{ inventory_hostname | to_json }}
data-dir: {{ etcd_data_dir | to_json }}
listen-client-urls: https://{{ etcd_address }}:{{ etcd_client_port }}
advertise-client-urls: https://{{ etcd_address }}:{{ etcd_client_port }}
listen-peer-urls: https://{{ etcd_address }}:{{ etcd_peer_port }}
initial-advertise-peer-urls: https://{{ etcd_address }}:{{ etcd_peer_port }}
initial-cluster: "{% for member in groups['etcd'] %}{{ member }}=https://{{ hostvars[member].etcd_address }}:{{ etcd_peer_port }}{{ ',' if not loop.last else '' }}{% endfor %}"
initial-cluster-token: {{ etcd_cluster_token | to_json }}
initial-cluster-state: new
# 已存在的数据目录优先；成员替换必须走单独 runbook，不删除数据重建。
client-transport-security:
  cert-file: {{ etcd_config_dir }}/server.crt
  key-file: {{ etcd_config_dir }}/server.key
  client-cert-file: {{ etcd_config_dir }}/gateway.crt
  client-key-file: {{ etcd_config_dir }}/gateway.key
  trusted-ca-file: {{ etcd_config_dir }}/ca.crt
  client-cert-auth: true
peer-transport-security:
  cert-file: {{ etcd_config_dir }}/peer.crt
  key-file: {{ etcd_config_dir }}/peer.key
  trusted-ca-file: {{ etcd_config_dir }}/ca.crt
  client-cert-auth: true
  allowed-cn: [homelab-etcd-peer]
# 独立 metrics listener 仅提供指标/健康，不开放 KV API；只绑定受管内网地址。
listen-metrics-urls: {{ etcd_metrics_urls | default("http://127.0.0.1:" ~ etcd_metrics_port) | to_json }}
quota-backend-bytes: {{ etcd_quota_bytes }}
auto-compaction-mode: periodic
auto-compaction-retention: '1h'
heartbeat-interval: 100
election-timeout: 1000
logger: zap
log-level: info