---
# Credentials must come from Vault or an existing Kubernetes Secret.
www_hostname: www.eom.dev
www_membership_image: registry.example.org/www-membership:2026-10-23
www_repo_version: refs/heads/main
www_membership_secret_name: www-membership-credentials
www_membership_shkeeper_enabled: true
www_membership_environment_overrides:
  # Optional plaintext LDAP for a trusted cluster only; sends passwords unencrypted.
  # Enable BOTH lines together. Omit them to retain the role's verified TLS default.
  # LDAP_URL: ldap://openldap.openldap.svc.cluster.local:389
  # LDAP_ALLOW_INSECURE: "1"
  LDAP_BIND_DN: cn=www-membership,ou=system,dc=eom,dc=dev
  LDAP_PASSWORD_SCHEME: "{ARGON2}"
  EMAIL_HOST: smtp.eom.dev
  STRIPE_PORTAL_CONFIGURATION: bpc_REPLACE
  SHKEEPER_URL: https://shkeeper.example.org
  SHKEEPER_CURRENCIES: BTC,XMR