## Values for openbao-gitops.
##
## `openbao:` maps directly onto the upstream openbao-helm chart values
## (https://github.com/openbao/openbao-helm). Only the settings relevant for
## a standalone/file-storage deployment with ESO integration are overridden
## here - see `helm show values openbao/openbao` for the full list.

openbao:
  server:
    # Standalone mode: single replica, file storage backend, PVC-backed.
    standalone:
      enabled: true
      # TLS terminated directly by OpenBao itself, using the cert-manager
      # issued self-signed certificate mounted below (see templates/tls.yaml
      # and the `tls:` section further down). "-tls-skip-verify" is already
      # baked into the chart's readiness/liveness probes, so this doesn't
      # need any extra values there.
      config: |
        ui = true

        listener "tcp" {
          tls_disable = 0
          address = "[::]:8200"
          cluster_address = "[::]:8201"
          tls_cert_file = "/openbao/userconfig/openbao-tls/tls.crt"
          tls_key_file  = "/openbao/userconfig/openbao-tls/tls.key"
        }
        storage "file" {
          path = "/openbao/data"
        }

    dataStorage:
      enabled: true
      size: 10Gi
      # Empty = cluster default StorageClass.
      storageClass: ""

    # Required so OpenBao's ServiceAccount can call the Kubernetes
    # TokenReview API - needed for the "kubernetes" auth method used by ESO.
    serviceAccount:
      create: true
      authDelegator:
        enabled: true

    # Mounts the cert-manager issued TLS secret at
    # /openbao/userconfig/openbao-tls/{tls.crt,tls.key,ca.crt}.
    extraVolumes:
      - type: secret
        name: openbao-tls

    resources:
      requests:
        cpu: 250m
        memory: 256Mi
      limits:
        cpu: 500m
        memory: 512Mi

    # The chart hardcodes BAO_ADDR=http://127.0.0.1:8200 for internal CLI
    # calls (readiness/liveness probes, etc.). Override it now that the
    # listener speaks TLS, otherwise the pod never becomes Ready.
    extraEnvironmentVars:
      BAO_ADDR: https://127.0.0.1:8200
      BAO_SKIP_VERIFY: "true"

  ui:
    enabled: true
    # NodePort, same pattern as ArgoCD (30080/30443) and Gitea (30300):
    # reachable at https://<node-ip>:30200 without needing an Ingress.
    serviceType: NodePort
    serviceNodePort: 30200

  injector:
    # Sidecar-injector webhook is not needed for ESO integration.
    enabled: false

# --- TLS (self-signed via cert-manager) -------------------------------------

tls:
  enabled: true
  secretName: openbao-tls
  # cert-manager Certificate validity/renewal.
  duration: 2160h # 90d
  renewBefore: 360h # 15d
  # Extra SANs beyond the in-cluster service names (which are always
  # included). Add your node IP(s)/hostname(s) here so browsers hitting the
  # NodePort get a matching cert.
  ipAddresses:
    - 192.168.2.218
  dnsNames: []

# --- ESO <-> OpenBao binding -------------------------------------------------

eso:
  # Namespace and ServiceAccount name that the External Secrets Operator
  # (its `SecretStore`/`ClusterSecretStore`) authenticates with. Must match
  # the ESO Helm release deployed via apps-in-apps.
  serviceAccountName: external-secrets
  namespace: external-secrets

  # Name of the Vault/OpenBao Kubernetes auth role that ESO will use.
  roleName: eso-role

  # KV v2 mount path that ClusterSecretStore(s) will read from.
  kvMountPath: secret

# One-time bootstrap Job that enables the Kubernetes auth method, creates the
# "eso-read" policy and the "eso-role" role bound to the ESO ServiceAccount.
#
# OpenBao must already be initialized AND unsealed before this can run (see
# README). Enable this only after that manual step, providing the root token
# via the referenced secret.
bootstrap:
  enabled: false
  image: openbao/openbao:2.6.2
  rootTokenSecretName: openbao-root-token
  rootTokenSecretKey: token