## Values for openbao-gitops.
##
## `openbao:` maps directly onto the upstream openbao-helm chart values
## (https://github.com/openbao/openbao-helm). Only the settings relevant for
## a standalone/file-storage deployment with ESO integration are overridden
## here - see `helm show values openbao/openbao` for the full list.

openbao:
  server:
    # Standalone mode: single replica, file storage backend, PVC-backed.
    standalone:
      enabled: true

    dataStorage:
      enabled: true
      size: 10Gi
      # Empty = cluster default StorageClass.
      storageClass: ""

    # Required so OpenBao's ServiceAccount can call the Kubernetes
    # TokenReview API - needed for the "kubernetes" auth method used by ESO.
    serviceAccount:
      create: true
      authDelegator:
        enabled: true

    resources:
      requests:
        cpu: 250m
        memory: 256Mi
      limits:
        cpu: 500m
        memory: 512Mi

  ui:
    enabled: true
    # NodePort, same pattern as ArgoCD (30080/30443) and Gitea (30300):
    # reachable at http://<node-ip>:30200 without needing an Ingress.
    serviceType: NodePort
    serviceNodePort: 30200

  injector:
    # Sidecar-injector webhook is not needed for ESO integration.
    enabled: false

# --- ESO <-> OpenBao binding -------------------------------------------------

eso:
  # Namespace and ServiceAccount name that the External Secrets Operator
  # (its `SecretStore`/`ClusterSecretStore`) authenticates with. Must match
  # the ESO Helm release deployed via apps-in-apps.
  serviceAccountName: external-secrets
  namespace: external-secrets

  # Name of the Vault/OpenBao Kubernetes auth role that ESO will use.
  roleName: eso-role

  # KV v2 mount path that ClusterSecretStore(s) will read from.
  kvMountPath: secret

# One-time bootstrap Job that enables the Kubernetes auth method, creates the
# "eso-read" policy and the "eso-role" role bound to the ESO ServiceAccount.
#
# OpenBao must already be initialized AND unsealed before this can run (see
# README). Enable this only after that manual step, providing the root token
# via the referenced secret.
bootstrap:
  enabled: false
  image: openbao/openbao:2.6.2
  rootTokenSecretName: openbao-root-token
  rootTokenSecretKey: token