[DEFAULT]
debug = {{ options.debug }}
lock_path = /var/lock/barbican
state_path = /var/lib/barbican

host_href = ""
transport_url = {{ amqp.transport_url }}

{% include "parts/section-database" %}

{% include "parts/section-identity" %}
# XXX Region should come from the id relation here
region_name = {{ options.region }}

{% include "parts/section-service-user" %}

[secretstore]
{% if vault_kv and vault_kv.approle_role_id -%}
enabled_secretstore_plugins = vault_plugin
{% else -%}
enabled_secretstore_plugins = store_crypto
{% endif -%}

[crypto]
enabled_crypto_plugins = simple_crypto

[simple_crypto_plugin]
# the kek should be a 32-byte value which is base64 encoded
kek = 'YWJjZGVmZ2hpamtsbW5vcHFyc3R1dnd4eXoxMjM0NTY='

{% if vault_kv and vault_kv.approle_secret_id -%}
[vault_plugin]
approle_role_id = {{ vault_kv.approle_role_id }}
approle_secret_id = {{ vault_kv.approle_secret_id }}
kv_mountpoint = {{ vault_kv.kv_mountpoint }}
vault_url = {{ vault_kv.vault_url }}
use_ssl = True
ssl_ca_crt_file = {{ vault_kv.ca_crt_file }}
{% endif -%}

{% include "parts/section-oslo-messaging-rabbit" %}