---
# Ansible Vault Template
# Copy this file to vault.yaml and encrypt it with:
#   ansible-vault encrypt vault.yaml
#
# Or create encrypted vault directly:
#   ansible-vault create vault.yaml
#
# This file contains all sensitive secrets used across the infrastructure

# ============================================================================
# S3 Object Storage Credentials
# ============================================================================
vault_s3_access_key: "YOUR_S3_ACCESS_KEY_HERE"
vault_s3_secret_key: "YOUR_S3_SECRET_KEY_HERE"

# Optional: Alternative S3 endpoint if not using default
# vault_s3_endpoint: "https://hel1.your-objectstorage.com"

# ============================================================================
# Forgejo Secrets
# ============================================================================
# Generate with: openssl rand -hex 32
vault_forgejo_secret_key: "GENERATE_64_CHAR_HEX_STRING_HERE"

# Generate with Forgejo or use existing JWT token
vault_forgejo_internal_token: "eyJhbGc..."

# Generate with: openssl rand -base64 32
vault_forgejo_jwt_secret: "GENERATE_BASE64_STRING_HERE"
vault_forgejo_lfs_jwt_secret: "GENERATE_BASE64_STRING_HERE"

# ============================================================================
# Forgejo Runner
# ============================================================================
# Generate from Forgejo UI: Site Admin → Actions → Runners → Create Runner
vault_forgejo_runner_token: "GENERATE_FROM_FORGEJO_UI"

# ============================================================================
# SSL/TLS Certificates
# ============================================================================
# Email for Let's Encrypt certificate notifications
vault_letsencrypt_email: "admin@example.com"

# ============================================================================
# Database Credentials (if needed for future services)
# ============================================================================
# vault_postgres_password: "GENERATE_SECURE_PASSWORD"
# vault_mysql_root_password: "GENERATE_SECURE_PASSWORD"
# vault_redis_password: "GENERATE_SECURE_PASSWORD"

# ============================================================================
# API Keys and Tokens (if needed for future services)
# ============================================================================
# vault_grafana_admin_password: "GENERATE_SECURE_PASSWORD"
# vault_immich_db_password: "GENERATE_SECURE_PASSWORD"