---
# Inventory for the OpenBao root-of-trust host.
# A single dedicated VM/host on the LAN (like the Samba DC) — NOT in the k8s cluster.
all:
  children:
    openbao:
      hosts:
        bao1:
          ansible_host: 192.168.10.8     # bao's static LAN IP — match openbao_lan_ip
          ansible_user: ansible          # cloud-init / provisioning user with sudo

    # Root-managed hosts that should trust bao's SSH user CA (TrustedUserCAKeys).
    # Add any node you want agents to reach with signed certs.
    ssh_ca_trust:
      hosts:
        bao1: {}                         # bao itself (connection vars from the openbao group)
        dc1:
          ansible_host: 192.168.10.5     # Samba AD DC
          ansible_user: ansible
        laptop:
          ansible_connection: local      # this machine (192.168.10.127), passwordless sudo
          ansible_host: 127.0.0.1