# Mounts the netbox token secrets engine at "netbox" and writes its config.
# The seeded NetBox admin token is sensitive and read from KV, not stored here:
#   kv/service/vault/au/syd1/secret_backend/netbox/config
#   -> key: admin_token (required)
# Populate that KV path with a purpose-built NetBox service token that has
# add_token + grant_token (or superuser) BEFORE applying, then run
# `vault write -f netbox/config/rotate` after the first apply so only Vault
# holds the live admin token.
#
# token_version 2 is the NetBox 4.6.5 default and requires API_TOKEN_PEPPERS to
# be configured on the NetBox server; set token_version: 1 here if the server
# has no peppers.
description: "NetBox ephemeral scoped API token engine"
netbox_url: "https://netbox.k8s.syd1.au.unkin.net"
token_version: 2
request_timeout_seconds: 30