---
data:
  type: volume
  name: openbao_data
  # nocheck: nfs-false-data-loss  Reason: raft/BoltDB (mmap + fsync) corrupts over NFS; single-replica and pinned via placement: manager.
  nfs: false
  mounts:
    - service: openbao
      target: /openbao/file

logs:
  type: volume
  name: openbao_logs
  # nocheck: nfs-false-data-loss  Reason: log output only, regenerated by the server; node pinned via placement: manager.
  nfs: false
  mounts:
    - service: openbao
      target: /openbao/logs

config:
  type: config
  source: "{{ [lookup('container', 'web-app-openbao', 'directories.config'), 'openbao.hcl'] | path_join }}"
  mode: "0444"
  mounts:
    - service: openbao
      target: /openbao/config/openbao.hcl

config_plugins:
  type: config
  source: "{{ [lookup('container', 'web-app-openbao', 'directories.config'), 'plugins.hcl'] | path_join }}"
  mode: "0444"
  mounts:
    - service: openbao
      target: /openbao/config/plugins.hcl

policy_ansible_admin:
  type: config
  source: "{{ [lookup('container', 'web-app-openbao', 'directories.config'), 'policies', 'ansible-admin.hcl'] | path_join }}"
  mode: "0444"
  mounts:
    - service: openbao
      target: /openbao/policies/ansible-admin.hcl

policy_administrator:
  type: config
  source: "{{ [lookup('container', 'web-app-openbao', 'directories.config'), 'policies', 'administrator.hcl'] | path_join }}"
  mode: "0444"
  mounts:
    - service: openbao
      target: /openbao/policies/administrator.hcl

policy_operator:
  type: config
  source: "{{ [lookup('container', 'web-app-openbao', 'directories.config'), 'policies', 'operator.hcl'] | path_join }}"
  mode: "0444"
  mounts:
    - service: openbao
      target: /openbao/policies/operator.hcl

policy_reader:
  type: config
  source: "{{ [lookup('container', 'web-app-openbao', 'directories.config'), 'policies', 'reader.hcl'] | path_join }}"
  mode: "0444"
  mounts:
    - service: openbao
      target: /openbao/policies/reader.hcl