---
# Whether to additionally pull the GUI package. Headless fleets should leave
# this off; desktop fleets that want the AuthForge settings panel can flip it.
authforge_install_gui: false

# PPA to install from. Override if you mirror packages internally.
authforge_ppa: "ppa:dangerousthings/authforge"

# Map of stack name -> { mode, methods }. mode is one of
# "disabled" | "optional" | "required". methods is a list e.g. ["fido2", "totp"].
# Default is empty so the role can be applied for "install only" runs.
authforge_stacks: {}

# Credential storage backend. "per-user" stores credentials under each user's
# home directory; "central" stores them at authforge_storage_central_path so
# they survive home-directory wipes (e.g. AD-managed boxes).
authforge_storage_backend: "per-user"
authforge_storage_central_path: ""

# First-login enforcement. Users who exist in the pending list will be required
# to enroll one of these methods on their next interactive login.
authforge_firstrun_methods:
  - "fido2"

# How long after the pending flag is set before the user is locked out if they
# have not enrolled. 0 means no deadline (warn forever).
authforge_firstrun_deadline_hours: 0

# Users to mark as pending-enrollment via `authforgectl pending set`.
# Each entry: { user: "alice", methods: ["fido2"] }.
authforge_pending_users: []