---
credentials:
  sso_proxy_cookie_secret:
    description: Cookie secret for the SSO-proxy sidecar (hex string, 32 characters, generated via `openssl rand -hex 16`)
    algorithm: plain
    validation: ^.*$
  administrator_password:
    description: Password for the Keycloak administrator user (used in bootstrap and CLI access)
    algorithm: sha256
    validation: ^[a-f0-9]{64}$
  oidc_client_secret:
    description: Client secret for the shared OIDC client; consumed by the SSO-proxy sidecar and the Keycloak realm client, and used as the default for
      OIDC.CLIENT.SECRET when the inventory sets none.
    algorithm: sha256
    validation: ^[a-f0-9]{64}$
  recaptcha:
    key:
      description: Runtime credential value imported from meta/services.yml for 'key'.
      algorithm: plain
      default: "{{ CAPTCHA.RECAPTCHA.KEY }}"
    secret:
      description: Runtime credential value imported from meta/services.yml for 'secret'.
      algorithm: plain
      default: "{{ CAPTCHA.RECAPTCHA.SECRET }}"