38 lines
1.3 KiB
YAML
38 lines
1.3 KiB
YAML
# Example vault-tools config. Copy to ~/.config/vcm/config.yaml
|
|
# and edit. Read by both vcm and vctx.
|
|
|
|
# File-level defaults applied to any context that doesn't set its own value.
|
|
defaults:
|
|
method: ldap # ldap | userpass | okta | radius | token | oidc
|
|
user: ben # login user (defaults to $USER if omitted)
|
|
# namespace: "" # optional default Vault namespace
|
|
|
|
contexts:
|
|
# Simplest form: just an address; inherits method/user from defaults.
|
|
sydney:
|
|
address: https://vault.syd1.au.unkin.net
|
|
|
|
# Slash-named context nests on disk as ~/.cache/vcm/staging/sydney.
|
|
staging/sydney:
|
|
address: https://vault-staging.syd1.au.unkin.net
|
|
namespace: staging
|
|
user: svc-ben # per-context override
|
|
|
|
# Custom auth method + mount path.
|
|
legacy:
|
|
address: https://vault-legacy.example.net
|
|
method: userpass
|
|
path: userpass2 # auth mount path (defaults to the method name)
|
|
|
|
# OIDC: one context per role, all on the same Vault.
|
|
sydney/admin:
|
|
address: https://vault.syd1.au.unkin.net
|
|
method: oidc
|
|
role: admin # OIDC role (default: the mount's default_role)
|
|
sydney/readonly:
|
|
address: https://vault.syd1.au.unkin.net
|
|
method: oidc
|
|
path: oidc # auth mount path (defaults to the method name)
|
|
role: readonly
|
|
# oidc_listen: localhost:8250 # local callback listener (default)
|