---
# MariaDB provisioning (non-secret defaults).

# Remote TCP admin user created by `mariadb_primary` for management.
k3s_mariadb_admin_user: prole_admin

# Keep the k3s datastore password vaulted.
# For consistency with existing k3s server configuration, reuse the AD DC's vaulted Samba DNS admin password.
# (This ensures k3s can authenticate to the datastore after migration.)
k3s_datastore_mariadb_password: "{{ hostvars[groups['ad_dc'][0]].vault_samba_dns_admin_pass }}"