ansible rework

ansible/inventory/group_vars/all/vault.yaml.template

@@ -0,0 +1,56 @@
+---
+# Ansible Vault Template
+# Copy this file to vault.yaml and encrypt it with:
+#   ansible-vault encrypt vault.yaml
+#
+# Or create encrypted vault directly:
+#   ansible-vault create vault.yaml
+#
+# This file contains all sensitive secrets used across the infrastructure
+
+# ============================================================================
+# S3 Object Storage Credentials
+# ============================================================================
+vault_s3_access_key: "YOUR_S3_ACCESS_KEY_HERE"
+vault_s3_secret_key: "YOUR_S3_SECRET_KEY_HERE"
+
+# Optional: Alternative S3 endpoint if not using default
+# vault_s3_endpoint: "https://hel1.your-objectstorage.com"
+
+# ============================================================================
+# Forgejo Secrets
+# ============================================================================
+# Generate with: openssl rand -hex 32
+vault_forgejo_secret_key: "GENERATE_64_CHAR_HEX_STRING_HERE"
+
+# Generate with Forgejo or use existing JWT token
+vault_forgejo_internal_token: "eyJhbGc..."
+
+# Generate with: openssl rand -base64 32
+vault_forgejo_jwt_secret: "GENERATE_BASE64_STRING_HERE"
+vault_forgejo_lfs_jwt_secret: "GENERATE_BASE64_STRING_HERE"
+
+# ============================================================================
+# Forgejo Runner
+# ============================================================================
+# Generate from Forgejo UI: Site Admin → Actions → Runners → Create Runner
+vault_forgejo_runner_token: "GENERATE_FROM_FORGEJO_UI"
+
+# ============================================================================
+# SSL/TLS Certificates
+# ============================================================================
+# Email for Let's Encrypt certificate notifications
+vault_letsencrypt_email: "admin@example.com"
+
+# ============================================================================
+# Database Credentials (if needed for future services)
+# ============================================================================
+# vault_postgres_password: "GENERATE_SECURE_PASSWORD"
+# vault_mysql_root_password: "GENERATE_SECURE_PASSWORD"
+# vault_redis_password: "GENERATE_SECURE_PASSWORD"
+
+# ============================================================================
+# API Keys and Tokens (if needed for future services)
+# ============================================================================
+# vault_grafana_admin_password: "GENERATE_SECURE_PASSWORD"
+# vault_immich_db_password: "GENERATE_SECURE_PASSWORD"