# Secrets the playbook reads from the environment. Copy this to playbook.env
# and fill it in. The values below are 1Password references, resolved by
# `op run --env-file=playbook.env -- ansible-playbook ...`, but any way of
# setting these environment variables works (direnv, CI secrets, export).
#
# The playbook refuses to run if any variable named here is empty.

# A fine-grained GitHub token with Administration: write on your config repo,
# used to add the Pi's deploy key.
PI_GITHUB_TOKEN=op://Private/Raspberry Pi/GitHub Token
# A Cloudflare API token with Zone:Read and DNS:Edit on the zone your admin
# hostname is in, so Caddy can get a certificate via DNS-01.
PI_CLOUDFLARE_TOKEN=op://Private/Raspberry Pi/Cloudflare Token
# bcrypt hash of the AdGuard admin password:
#   htpasswd -nbB -C 10 admin 'your-password' | cut -d: -f2
PI_ADGUARD_ADMIN_HASH=op://Private/Raspberry Pi/AdGuard password hash