# Example vault-tools config. Copy to ~/.config/vcm/config.yaml
# and edit. Read by both vcm and vctx.

# File-level defaults applied to any context that doesn't set its own value.
defaults:
  method: ldap        # ldap | userpass | okta | radius | token | oidc
  user: ben           # login user (defaults to $USER if omitted)
  # namespace: ""     # optional default Vault namespace

contexts:
  # Simplest form: just an address; inherits method/user from defaults.
  sydney:
    address: https://vault.syd1.au.unkin.net

  # Slash-named context nests on disk as ~/.cache/vcm/staging/sydney.
  staging/sydney:
    address: https://vault-staging.syd1.au.unkin.net
    namespace: staging
    user: svc-ben     # per-context override

  # Custom auth method + mount path.
  legacy:
    address: https://vault-legacy.example.net
    method: userpass
    path: userpass2   # auth mount path (defaults to the method name)

  # OIDC: one context per role, all on the same Vault.
  sydney/admin:
    address: https://vault.syd1.au.unkin.net
    method: oidc
    role: admin       # OIDC role (default: the mount's default_role)
  sydney/readonly:
    address: https://vault.syd1.au.unkin.net
    method: oidc
    path: oidc        # auth mount path (defaults to the method name)
    role: readonly
    # oidc_listen: localhost:8250   # local callback listener (default)