---
cloud_apps: /opt
cloud_storage: /opt/storage
cloud_stage: prod
cloud_update: false
domain_external: "my-domain.tld"


vaultwarden_version: 1.37.4
vaultwarden_image: ghcr.io/dani-garcia/vaultwarden

vaultwarden_domain: "vault.{{ domain_external }}"
vaultwarden_http_port: 8222
vaultwarden_data_location: "{{ cloud_storage }}/vaultwarden-data"

vaultwarden_signups_allowed: false
#comma separated domains that may sign up even with sign ups disabled
vaultwarden_signups_domains_whitelist: ""
vaultwarden_signups_verify: true
vaultwarden_invitations_allowed: true
vaultwarden_invitation_org_name: "Vaultwarden"
vaultwarden_show_password_hint: false
vaultwarden_password_iterations: 600000

#argon2 PHC string (vaultwarden hash); empty disables the admin panel
vaultwarden_admin_token:

vaultwarden_smtp_host: "mail.{{ domain_external }}"
vaultwarden_smtp_port: 465
vaultwarden_smtp_security: force_tls
vaultwarden_smtp_from: "noreply@{{ domain_external }}"
vaultwarden_smtp_from_name: Vaultwarden
vaultwarden_smtp_user: user@my-domain.tld
vaultwarden_smtp_pass: ThisCouldBeYourAdd

vaultwarden_loglevel: warn

#OpenID Connect single sign on (login only; the master password still decrypts the vault)
vaultwarden_sso_enabled: false
vaultwarden_sso_only: false
vaultwarden_sso_signups_match_email: true
vaultwarden_sso_authority: "https://idp.{{ domain_external }}/application/o/{{ vaultwarden_sso_slug }}/"
vaultwarden_sso_scopes: "email profile offline_access"
vaultwarden_sso_client_id: vaultwarden
vaultwarden_sso_client_secret: SSOClientSecret

#create provider + application in a local authentik through a blueprint
vaultwarden_sso_authentik: false
vaultwarden_sso_slug: vaultwarden
vaultwarden_sso_name: Vaultwarden
vaultwarden_sso_authentik_data: "{{ cloud_apps }}/authentik/inst/data"
vaultwarden_sso_authentik_container: inst-worker-1
vaultwarden_sso_authentik_signing_key: "authentik Self-signed Certificate"
vaultwarden_sso_authentik_authorization_flow: default-provider-authorization-implicit-consent
vaultwarden_sso_authentik_invalidation_flow: default-provider-invalidation-flow