vault:
  # This started as your live `helm get values vault -n vault` output,
  # verbatim. One deliberate deviation from that since: injector.enabled
  # is now false, not true. Secret delivery into pods is going through
  # External Secrets Operator instead of Vault Agent Injector sidecars —
  # nothing currently depends on the injector (claude.md's "Pending / not
  # yet built" list has "Vault Agent Injector annotations for pulling
  # secrets at pod start" — never actually wired up to any workload), so
  # this removes an unused webhook rather than breaking anything live.
  #
  # Production mode (file storage, not dev), standalone (no HA/raft).
  # Init/unseal are still NEVER in Git or scripted: run by hand and keep
  # the unseal keys / root token in a password manager, same as claude.md
  # says. This adoption only manages Vault's own Deployment config, not
  # its data or seal state.
  #
  # `ui = true` in the HCL block AND top-level ui.enabled: true are BOTH
  # required — this is claude.md issue #10 (Vault UI 404'd until both were
  # set; the chart has two separate toggles for the same thing).
  injector:
    enabled: false

  server:
    dataStorage:
      enabled: true
      # Must stay 5Gi to match the already-bound PVC — local-path-provisioner
      # doesn't support volume expansion, same constraint as Gitea's PVC.
      size: 5Gi
    ha:
      enabled: false
    resources:
      limits:
        memory: 256Mi
      requests:
        cpu: 100m
        memory: 128Mi
    standalone:
      enabled: true
      config: |
        ui = true
        listener "tcp" {
          address = "[::]:8200"
          cluster_address = "[::]:8201"
          tls_disable = "true"   # lab only - enable TLS for anything beyond local testing
        }
        storage "file" {
          path = "/vault/data"
        }

    # No ingress config existed here before — access was via two raw,
    # unmanaged Ingress objects (vault-ingress, vault-ingress-tailscale)
    # that don't match anything Helm would generate, so this creates new
    # GitOps-managed ones alongside them rather than adopting. Once these
    # are confirmed working, the two raw ones should be deleted by hand
    # (kubectl -n vault delete ingress vault-ingress vault-ingress-tailscale)
    # — do that only after confirming, not before, so there's no access gap.
    ingress:
      enabled: true
      ingressClassName: contour
      hosts:
        - host: "vault.192.168.1.7.nip.io"
          paths: []
        - host: "vault.100.90.248.118.nip.io"
          paths: []

  ui:
    enabled: true