33 lines
1.4 KiB
Text
33 lines
1.4 KiB
Text
# Encrypted secrets for the Morphit Ansible playbook.
|
|
#
|
|
# Encrypt with:
|
|
# ansible-vault encrypt group_vars/vault.yml
|
|
#
|
|
# Edit with:
|
|
# ansible-vault edit group_vars/vault.yml
|
|
#
|
|
# DO NOT commit this file decrypted. DO NOT lose your vault
|
|
# password — there is no recovery.
|
|
#
|
|
# Referenced from group_vars/all.yml as {{ vault_<name> }}.
|
|
|
|
---
|
|
# Postgres password. Generate with:
|
|
# openssl rand -base64 32 | tr -d /+= | head -c 32
|
|
# (One shared database — indexer + relay both use it — so one password.)
|
|
vault_postgres_indexer_password: REPLACE-ME-WITH-RANDOM-32-CHAR-STRING
|
|
|
|
# Relay keystore passphrase. This decrypts the BLURT active key
|
|
# file on disk. Strong passphrase recommended (24+ chars random).
|
|
vault_relay_keystore_passphrase: REMOVED # Part 122 cp5 F13: no env path consumes this. Relay unlocks via TTY prompt or systemd LoadCredential.
|
|
|
|
# SMTP credentials for outbound alerts.
|
|
vault_alert_smtp_password: REPLACE-ME-WITH-SMTP-PASSWORD
|
|
|
|
# Matrix-bot access token — only needed if enable_matrix_bot is
|
|
# true. Mint by signing into the bot account in a regular Matrix
|
|
# client and copying the access token from Settings → Help &
|
|
# About → Access Token. This is a long-lived secret — anyone
|
|
# with it can impersonate the bot account. Rotate immediately if
|
|
# you suspect it's leaked.
|
|
vault_matrix_bot_access_token: REPLACE-ME-WITH-MATRIX-BOT-ACCESS-TOKEN
|