---
vault_addr: "http://VAULT_IP:VAULT_PORT"

vault_agent_config_path: "/etc/vault-agent-config.hcl"
vault_agent_pid_file: "/var/run/vault-agent.pid"
vault_agent_user: "root"
vault_agent_service: "vault-agent"
vault_agent_systemd_unit: "/etc/systemd/system/vault-agent.service"

# Paths to role_id / secret_id files (written by bootstrap process)
vault_role_id_file: "/etc/vault-agent/role_id"
vault_secret_id_file: "/etc/vault-agent/secret_id"

# Templates
vault_templates_dir: "/etc/vault-agent-templates"

vault_agent_templates:
  # HAProxy
  - src: "haproxy.pem.ctmpl"
    dest: "/etc/haproxy/certs/haproxy.pem"
    service: haproxy
  - src: "haproxy_ca.ctmpl"
    dest: "/etc/haproxy/certs/haproxy_ca.crt"
    service: haproxy
  - src: "thesabear-client.ctmpl"
    dest: "/etc/haproxy/certs/clients/thesabear-client.pem"
    service: "haproxy"

  # Technitium
  - src: "technitium_cert.ctmpl"
    dest: "/etc/technitium/certs/technitium.crt"
    service: technitium
  - src: "technitium_key.ctmpl"
    dest: "/etc/technitium/certs/technitium.key"
    service: technitium
  - src: "technitium_ca.ctmpl"
    dest: "/etc/technitium/certs/technitium_ca.crt"
    service: technitium

# Default Vault PKI options (can remain)
pki_mount_path: "pki"