# Purpose-built Gitea site-admin bot for the vault-plugin-secrets-gitea engine.
# The engine seeds itself from this account's credentials (Basic Auth) to mint
# and delete per-user tokens for any user. Its randomly generated password is
# written ONCE to Vault KV (vault_seed_path below) and never updated after; the
# Vault gitea engine reads that seed only when first creating gitea/config and
# then rotates it (rotate-root) so only Vault holds the live password.
#
# A local (not external-auth) account with 2FA disabled is required so the
# engine can change the password via the admin API during rotate-root.
email: gitea-vault-admin@unkin.net
full_name: "Gitea Vault Admin"
description: "site-admin bot; credentials seeded to Vault for vault-plugin-secrets-gitea"
# Site admin so the engine may mint/delete tokens for any user. No org/repo
# creation; profile visible only to signed-in users.
visibility: limited
admin: true
allow_create_organization: false
max_repo_creation: 0
# Seed this account's generated password to Vault KV (mount "kv") at this path,
# where the Vault gitea secrets engine reads it at creation time. Written once.
vault_seed_path: "service/vault/au/syd1/secret_backend/gitea/config"