ui = false

# Tiny dedicated instance whose ONLY job is to hold a transit key that
# auto-unseals the main OpenBAO node. It is itself Shamir-sealed (unsealed
# manually or by a boot script). Keep its footprint minimal.
storage "raft" {
  path    = "/openbao/file"
  node_id = "unsealer-node-1"
}

listener "tcp" {
  address     = "0.0.0.0:8200"
  tls_disable = 1
}

api_addr     = "http://openbao-unsealer:8200"
cluster_addr = "https://openbao-unsealer:8201"

# OpenBAO 2.x: no mlock; disable/encrypt host swap instead.