18 lines
971 B
YAML
18 lines
971 B
YAML
---
|
|
# HashiCorp Vault connection. VAULT_ADDR/VAULT_TOKEN (or VAULT_ROLE_ID /
|
|
# VAULT_SECRET_ID for AppRole) are read from the environment of whatever is
|
|
# running ansible-playbook — a local shell during bootstrap, or Forgejo
|
|
# Actions secrets once CI is wired up. Never hardcode a token here.
|
|
vault_addr: "{{ lookup('env', 'VAULT_ADDR') }}"
|
|
vault_kv_mount: kv
|
|
|
|
# AppRole auth (used by CI). Leave unset for local token-based auth
|
|
# (`vault login` + VAULT_TOKEN env var) during bootstrap.
|
|
vault_auth_method: "{{ lookup('env', 'VAULT_AUTH_METHOD') | default('token', true) }}"
|
|
vault_role_id: "{{ lookup('env', 'VAULT_ROLE_ID') | default(omit) }}"
|
|
vault_secret_id: "{{ lookup('env', 'VAULT_SECRET_ID') | default(omit) }}"
|
|
|
|
# Where Compose Manager (the Unraid Docker Compose plugin) expects project
|
|
# folders. Verify this against your plugin version — override per-host in
|
|
# host_vars if yours differs.
|
|
compose_projects_root: /boot/config/plugins/compose.manager/projects
|