---
# Template for sensitive variables.
#
# Usage:
#   1. cp secrets.yml.example secrets.yml
#   2. Fill in the values below
#   3. ansible-vault encrypt vault/secrets.yml
#   4. Store the vault password in .vault_pass (chmod 600, do NOT commit it)
#      or wire it up to your organization's secret store.

# identity_ad
ad_join_username: "svc-linuxjoin"
ad_join_password: "CHANGE_ME"

# falcon_onboarding
falcon_cid: "CHANGE_ME-CID-FROM-FALCON-CONSOLE"
falcon_onboarding_provisioning_token: ""

# cis_hardening: GRUB bootloader password
# Generate the hash beforehand with: grub2-mkpasswd-pbkdf2
# Only relevant if cis_grub_password_enabled: true
grub_bootloader_password_hash: ""

# local_accounts: the break-glass account password is intentionally NOT
# managed here. Ansible only creates the account with a locked password
# hash; set the real password manually on the host and store it in your
# organization's password safe.