From f2919cf50ad56ba4effbeea30e949d8326535424 Mon Sep 17 00:00:00 2001
From: Lutz Finsterle <lutz.finsterle@t-online.de>
Date: Sat, 1 Aug 2026 10:20:12 +0200
Subject: [PATCH] Add daily app-token renewal (script + systemd timer)

Periodic scoped tokens (~/.config/openbao/*.token) expired because nothing
renewed them within their period. renew-app-tokens.sh renews all of them via
auth/token/renew-self; openbao-token-renew.timer runs it daily (Persistent=true).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 scripts/renew-app-tokens.sh         | 29 +++++++++++++++++++++++++++++
 systemd/openbao-token-renew.service | 12 ++++++++++++
 systemd/openbao-token-renew.timer   | 10 ++++++++++
 3 files changed, 51 insertions(+)
 create mode 100755 scripts/renew-app-tokens.sh
 create mode 100644 systemd/openbao-token-renew.service
 create mode 100644 systemd/openbao-token-renew.timer

diff --git a/scripts/renew-app-tokens.sh b/scripts/renew-app-tokens.sh
new file mode 100755
index 0000000..5dfce73
--- /dev/null
+++ b/scripts/renew-app-tokens.sh
@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+# Renew every scoped OpenBAO app token so periodic tokens never lapse. Periodic
+# tokens live only as long as they're renewed within their period; nothing was
+# renewing these, so they expired (2026-08-01). Runs daily via a systemd timer.
+#
+# Best-effort: reads each ~/.config/openbao/*.token and calls renew-self. A dead
+# token logs a failure but never aborts the rest. No secrets are printed.
+set -uo pipefail
+ADDR="${BAO_ADDR:-http://127.0.0.1:8200}"
+DIR="$HOME/.config/openbao"
+LOG="$DIR/token-renew.log"
+ts="$(date '+%F %T %Z')"
+shopt -s nullglob
+
+renewed=0; failed=0
+for tf in "$DIR"/*.token; do          # *.token only — backup files (*.token.bak.*) don't match
+  tok="$(cat "$tf" 2>/dev/null)"
+  name="$(basename "$tf")"
+  [ -n "$tok" ] || { echo "$ts $name EMPTY" >> "$LOG"; failed=$((failed+1)); continue; }
+  resp="$(curl -sS --max-time 10 -H "X-Vault-Token: $tok" -X POST "$ADDR/v1/auth/token/renew-self" 2>/dev/null)"
+  ttl="$(printf '%s' "$resp" | jq -r '.auth.lease_duration // empty' 2>/dev/null)"
+  if [ -n "$ttl" ]; then
+    echo "$ts $name renewed ttl=${ttl}s" >> "$LOG"; renewed=$((renewed+1))
+  else
+    echo "$ts $name RENEW FAILED: $(printf '%s' "$resp" | jq -c '.errors // .' 2>/dev/null)" >> "$LOG"; failed=$((failed+1))
+  fi
+done
+echo "$ts summary: renewed=$renewed failed=$failed" >> "$LOG"
+[ "$failed" -eq 0 ]
diff --git a/systemd/openbao-token-renew.service b/systemd/openbao-token-renew.service
new file mode 100644
index 0000000..f1f8c5d
--- /dev/null
+++ b/systemd/openbao-token-renew.service
@@ -0,0 +1,12 @@
+[Unit]
+Description=Renew scoped OpenBAO app tokens so periodic tokens never lapse
+After=network-online.target docker.service
+Wants=network-online.target
+Requires=docker.service
+
+[Service]
+Type=oneshot
+User=lutz
+Group=lutz
+ExecStart=/home/lutz/Projects/OpenBAO/scripts/renew-app-tokens.sh
+# Renews ~/.config/openbao/*.token via auth/token/renew-self. Best-effort.
diff --git a/systemd/openbao-token-renew.timer b/systemd/openbao-token-renew.timer
new file mode 100644
index 0000000..bd2b63e
--- /dev/null
+++ b/systemd/openbao-token-renew.timer
@@ -0,0 +1,10 @@
+[Unit]
+Description=Daily renewal of scoped OpenBAO app tokens
+
+[Timer]
+OnCalendar=daily
+Persistent=true
+RandomizedDelaySec=1h
+
+[Install]
+WantedBy=timers.target