# Non-secret production template — copy to ~/.config/warden/warden.yaml
# Never commit tokens or CA private keys. See wiki/OpsWardenConfig.md

backend: vault

vault:
  addr: https://bao.coulomb.social
  mount: ssh
  role_map:
    adm: adm-role
    agt: agt-role
    atm: atm-role
  token_env: VAULT_TOKEN

inventory_path: ~/.config/warden/inventory.yaml
state_dir: ~/.local/state/warden

# Zone-aware flex-auth gate. Missing target membership is the explicit unknown
# profile; there is no repo-wide enable switch.
# Registry: registry/flex-auth/production_registry_snapshot.json (build from inventory).
# See wiki/PolicyGatedSigning.md (operator checklist) and wiki/playbooks/operator-openbao-token-hygiene.md
policy:
  # The in-cluster pin for ops-warden's signing policy (FLEX-WP-0016). A bare
  # flex-auth.flex-auth.svc Service does not exist. From a workstation, reach it
  # through a port-forward or tunnel and point this at that local address.
  flex_auth_url: http://flex-auth-ops-warden.flex-auth.svc.cluster.local:8080
  zone_registry_path: registry/flex-auth/production_registry_snapshot.json
  failure_modes:
    z0-experimental: fail_open
    z1-operational: fail_open
    z2-protected: fail_open
    z2-continuity: fail_open
    z3-critical: fail_closed
    unknown: fail_open
    not-applicable: fail_closed
  tenant: tenant:platform
  subject_env: WARDEN_POLICY_SUBJECT
  system: ops-warden
  # How ops-warden proves it is ops-warden. flex-auth TokenReviews this bearer
  # token and requires the principal system:serviceaccount:ops-warden:ops-warden
  # for resource.system: ops-warden. Mode none sends no header, which is what
  # holds the pin in warn.
  caller_auth:
    mode: none  # none | file | env | command
    # In-cluster PEP — projected ServiceAccount token, audience-bound:
    # mode: file
    # token_path: /var/run/secrets/flex-auth/token
    # Workstation — mint a short-lived bound token per call:
    # mode: command
    # command: kubectl create token ops-warden -n ops-warden
    #   --audience flex-auth --duration 10m
    token_env: WARDEN_POLICY_CALLER_TOKEN
    audience: flex-auth