ui = true

# Integrated Raft storage — self-contained, supports snapshot backups.
# Path is /openbao/file because that directory is pre-created in the image
# owned by the unprivileged "openbao" user; a named volume mounted there
# inherits that ownership and is writable after the entrypoint drops root.
storage "raft" {
  path    = "/openbao/file"
  node_id = "openbao-node-1"
}

# API listener. TLS is disabled here for an initial home-lab setup; the
# expectation is that a reverse proxy (Caddy/Traefik/nginx) terminates TLS,
# or you enable native TLS below. Do NOT expose this port to the internet
# without TLS in front of it.
listener "tcp" {
  address     = "0.0.0.0:8200"
  tls_disable = 1

  # To enable native TLS instead of a reverse proxy:
  #   tls_disable   = 0
  #   tls_cert_file = "/openbao/config/tls/cert.pem"
  #   tls_key_file  = "/openbao/config/tls/key.pem"
}

# Advertised addresses. api_addr is the external URL clients/UI use — here the
# Traefik-fronted HTTPS name. cluster_addr is for Raft peer traffic (single node).
api_addr     = "https://openbao.famfi.home"
cluster_addr = "https://openbao:8201"

# NOTE: OpenBAO 2.x removed mlock support. Instead, disable or encrypt swap
# on the host so secrets can't leak to disk. See:
# https://openbao.org/docs/install/#post-installation-hardening