Lutz Finsterle
14f46e1082
Build out the home-lab OpenBAO deployment beyond the basic node: - docker-compose: add openbao-unsealer sidecar; main node now transit auto-unseals against it (seal config kept in gitignored config/seal.hcl) - policies/admin.hcl: non-root admin policy; per-engine rules for ssh/pki/pki_int/totp/transit - Internal two-tier CA (pki/ root + pki_int/ intermediate) issues the openbao.famfi.home leaf Traefik serves; root CA published under ca/ - scripts/ + systemd/: daily cert renewal and Raft snapshot backups (both instances), with scoped tokens stored outside the repo - README: full runbook (auto-unseal, PKI, renewal, backups, DR/restore) Secrets (init/unsealer keys, tokens, seal stanza) stay gitignored. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
20 lines
520 B
HCL
20 lines
520 B
HCL
ui = false
|
|
|
|
# Tiny dedicated instance whose ONLY job is to hold a transit key that
|
|
# auto-unseals the main OpenBAO node. It is itself Shamir-sealed (unsealed
|
|
# manually or by a boot script). Keep its footprint minimal.
|
|
storage "raft" {
|
|
path = "/openbao/file"
|
|
node_id = "unsealer-node-1"
|
|
}
|
|
|
|
listener "tcp" {
|
|
address = "0.0.0.0:8200"
|
|
tls_disable = 1
|
|
}
|
|
|
|
api_addr = "http://openbao-unsealer:8200"
|
|
cluster_addr = "https://openbao-unsealer:8201"
|
|
|
|
# OpenBAO 2.x: no mlock; disable/encrypt host swap instead.
|