---
# HashiCorp Vault connection. VAULT_ADDR/VAULT_TOKEN (or VAULT_ROLE_ID /
# VAULT_SECRET_ID for AppRole) are read from the environment of whatever is
# running ansible-playbook — a local shell during bootstrap, or Forgejo
# Actions secrets once CI is wired up. Never hardcode a token here.
vault_addr: "{{ lookup('env', 'VAULT_ADDR') }}"
vault_kv_mount: kv

# AppRole auth (used by CI). Leave unset for local token-based auth
# (`vault login` + VAULT_TOKEN env var) during bootstrap.
vault_auth_method: "{{ lookup('env', 'VAULT_AUTH_METHOD') | default('token', true) }}"
vault_role_id: "{{ lookup('env', 'VAULT_ROLE_ID') | default(omit) }}"
vault_secret_id: "{{ lookup('env', 'VAULT_SECRET_ID') | default(omit) }}"

# Where Compose Manager (the Unraid Docker Compose plugin) expects project
# folders. Verify this against your plugin version — override per-host in
# host_vars if yours differs.
compose_projects_root: /boot/config/plugins/compose.manager/projects