56 lines
2.4 KiB
Text
56 lines
2.4 KiB
Text
---
|
|
# Ansible Vault Template
|
|
# Copy this file to vault.yaml and encrypt it with:
|
|
# ansible-vault encrypt vault.yaml
|
|
#
|
|
# Or create encrypted vault directly:
|
|
# ansible-vault create vault.yaml
|
|
#
|
|
# This file contains all sensitive secrets used across the infrastructure
|
|
|
|
# ============================================================================
|
|
# S3 Object Storage Credentials
|
|
# ============================================================================
|
|
vault_s3_access_key: "YOUR_S3_ACCESS_KEY_HERE"
|
|
vault_s3_secret_key: "YOUR_S3_SECRET_KEY_HERE"
|
|
|
|
# Optional: Alternative S3 endpoint if not using default
|
|
# vault_s3_endpoint: "https://hel1.your-objectstorage.com"
|
|
|
|
# ============================================================================
|
|
# Forgejo Secrets
|
|
# ============================================================================
|
|
# Generate with: openssl rand -hex 32
|
|
vault_forgejo_secret_key: "GENERATE_64_CHAR_HEX_STRING_HERE"
|
|
|
|
# Generate with Forgejo or use existing JWT token
|
|
vault_forgejo_internal_token: "eyJhbGc..."
|
|
|
|
# Generate with: openssl rand -base64 32
|
|
vault_forgejo_jwt_secret: "GENERATE_BASE64_STRING_HERE"
|
|
vault_forgejo_lfs_jwt_secret: "GENERATE_BASE64_STRING_HERE"
|
|
|
|
# ============================================================================
|
|
# Forgejo Runner
|
|
# ============================================================================
|
|
# Generate from Forgejo UI: Site Admin → Actions → Runners → Create Runner
|
|
vault_forgejo_runner_token: "GENERATE_FROM_FORGEJO_UI"
|
|
|
|
# ============================================================================
|
|
# SSL/TLS Certificates
|
|
# ============================================================================
|
|
# Email for Let's Encrypt certificate notifications
|
|
vault_letsencrypt_email: "admin@example.com"
|
|
|
|
# ============================================================================
|
|
# Database Credentials (if needed for future services)
|
|
# ============================================================================
|
|
# vault_postgres_password: "GENERATE_SECURE_PASSWORD"
|
|
# vault_mysql_root_password: "GENERATE_SECURE_PASSWORD"
|
|
# vault_redis_password: "GENERATE_SECURE_PASSWORD"
|
|
|
|
# ============================================================================
|
|
# API Keys and Tokens (if needed for future services)
|
|
# ============================================================================
|
|
# vault_grafana_admin_password: "GENERATE_SECURE_PASSWORD"
|
|
# vault_immich_db_password: "GENERATE_SECURE_PASSWORD"
|