# Cookbook:: irrigate-vault
# Attributes:: server

default['vault']['server']['aws_credentials_data_bag_name'] = 'dev_vault_aws_credentials'

default['vault']['server']['config']['api_addr'] = 'https://127.0.0.1:8200'
default['vault']['server']['config']['cluster_addr'] = 'https://127.0.0.1:8201'
default['vault']['server']['config']['disable_mlock'] = true
default['vault']['server']['config']['log_level'] = 'info'

default['vault']['server']['config']['listener']['address'] = '0.0.0.0:8200'
default['vault']['server']['config']['listener']['cluster_address'] = '0.0.0.0:8201'
default['vault']['server']['config']['listener']['tls_cert_file'] = '/opt/vault/tls/tls.crt'
default['vault']['server']['config']['listener']['tls_key_file'] = '/opt/vault/tls/tls.key'
default['vault']['server']['config']['listener']['tls_min_version'] = 'tls13'
default['vault']['server']['config']['listener']['telemetry']['unauthenticated_metrics_access'] = true

default['vault']['server']['config']['storage']['type'] = 'raft'
default['vault']['server']['config']['storage']['node_id'] = node['hostname']
default['vault']['server']['config']['storage']['path'] = '/var/lib/vault'
default['vault']['server']['config']['storage']['retry_join'] = []

default['vault']['server']['config']['seal']['type'] = 'awskms'
default['vault']['server']['config']['seal']['region'] = 'us-east-1'
default['vault']['server']['config']['seal']['kms_key_id'] = 'alias/dev-vault'

default['vault']['server']['config']['telemetry']['prometheus_retention_time'] = '30s'
default['vault']['server']['config']['telemetry']['disable_hostname'] = true