lutz/OpenBAO
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Renew the transit seal token so auto-unseal survives a reboot

Browse Source 
The main node's transit seal token (config/seal.hcl) lives on the unsealer
and was never renewed. It lapsed, and after the 2026-09-17 reboot main
crash-looped with 403 on transit/encrypt/autounseal even once the unsealer
was unsealed. renew-app-tokens.sh now parses it out of seal.hcl and renews
it via the same docker-exec path as the unsealer backup token.

Also widen .gitignore to config/seal.hcl* so timestamped backups of the
file (which contain the token) cannot be committed.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
Lutz FInsterle
2026-09-18 10:10:18 +02:00
parent 055676c186
commit fef9e7f1ae
2 changed files with 13 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
.gitignore vendored
View File

@@ -3,7 +3,7 @@ unseal-keys.json
init-output.json
unsealer-init.json
admin-credentials.txt
config/seal.hcl
config/seal.hcl*
*.token
config/tls/
data/