---
credentials:
  seal_key:
    description: 32-byte AES-256-GCM-96 key for the OpenBao static seal, injected as env://OPENBAO_SEAL_KEY. Every backup of the raft volume is undecryptable
      without it; its authoritative home is the encrypted inventory. Pinned because the static seal carries only one generation, so a deploy that skips a
      generation, or dies between the two AppRole pins, puts the store outside that window and leaves it recoverable only from a volume backup plus the key that
      wraps it. Rotate it deliberately by changing the inventory value; openbao.hcl.j2 still renders the previous_key pair for that.
    algorithm: random_hex_32
    validation: non_empty_string
    rotatable: false
  approle_role_id:
    description: RoleID of the Ansible AppRole, written to auth/approle/role/ansible/role-id at bootstrap so later deploys authenticate without a stored root
      token.
    algorithm: alphanumeric
    validation: non_empty_string
  approle_secret_id:
    description: SecretID of the Ansible AppRole, written to auth/approle/role/ansible/custom-secret-id at bootstrap.
    algorithm: alphanumeric
    validation: non_empty_string