Lutz Finsterle 21929fa899 Add personal-backup playground (KV + transit) and AppRole demo ...

Two isolated personal-credential backup options to evaluate, both excluded
from the admin policy (root-only break-glass):
- Scenario A: personal/ KV v2 (versioned) + personal-{put,get,list}.sh
- Scenario B: transit-personal/ key personal-backup + secret-{encrypt,decrypt}.sh

Plus an AppRole example of how a system should consume a secret:
- demo-app role/policy (read-only secret/demo-app/*), short-lived tokens
- scripts/app-get-secret.sh: login (role_id+secret_id) -> token -> read

All tokens/credentials live under ~/.config/openbao (outside the repo).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-06-28 20:28:32 +02:00

371 B

Executable File

Raw Permalink Blame History

View Raw