## 1. Enable & configure JWT auth in Vault

```bash
vault auth enable jwt

vault write auth/jwt/config \
  bound_issuer="https://gitea.home.hrajfrisbee.cz" \
  jwks_url="https://gitea.home.hrajfrisbee.cz/login/oauth/keys"

```