Lutz Finsterle
14f46e1082
Build out the home-lab OpenBAO deployment beyond the basic node: - docker-compose: add openbao-unsealer sidecar; main node now transit auto-unseals against it (seal config kept in gitignored config/seal.hcl) - policies/admin.hcl: non-root admin policy; per-engine rules for ssh/pki/pki_int/totp/transit - Internal two-tier CA (pki/ root + pki_int/ intermediate) issues the openbao.famfi.home leaf Traefik serves; root CA published under ca/ - scripts/ + systemd/: daily cert renewal and Raft snapshot backups (both instances), with scoped tokens stored outside the repo - README: full runbook (auto-unseal, PKI, renewal, backups, DR/restore) Secrets (init/unsealer keys, tokens, seal stanza) stay gitignored. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
43 lines
2.4 KiB
HCL
43 lines
2.4 KiB
HCL
# Admin policy — broad day-to-day administration WITHOUT being root.
|
|
# Deliberately omits the most dangerous root-only capabilities (sys/raw,
|
|
# generating root tokens, re-keying, raw storage access). Use the root token
|
|
# only for break-glass operations; this policy is for normal admin work.
|
|
|
|
# Manage auth methods
|
|
path "auth/*" { capabilities = ["create", "read", "update", "patch", "delete", "list", "sudo"] }
|
|
path "sys/auth/*" { capabilities = ["create", "read", "update", "delete", "sudo"] }
|
|
path "sys/auth" { capabilities = ["read"] }
|
|
|
|
# Manage ACL policies
|
|
path "sys/policies/acl/*" { capabilities = ["create", "read", "update", "delete", "list"] }
|
|
path "sys/policies/acl" { capabilities = ["list"] }
|
|
|
|
# Manage secrets engines (mount/tune/unmount)
|
|
path "sys/mounts/*" { capabilities = ["create", "read", "update", "delete", "sudo"] }
|
|
path "sys/mounts" { capabilities = ["read"] }
|
|
|
|
# Work with secrets data in mounted engines. One rule per engine mount path.
|
|
# NOTE: each secrets engine mounted at a NEW path needs its own rule here.
|
|
# The UI runs a preflight capability check on the mount path, so missing = 403.
|
|
path "secret/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] }
|
|
path "ssh/*" { capabilities = ["create", "read", "update", "patch", "delete", "list", "sudo"] }
|
|
path "pki/*" { capabilities = ["create", "read", "update", "patch", "delete", "list", "sudo"] }
|
|
path "pki_int/*" { capabilities = ["create", "read", "update", "patch", "delete", "list", "sudo"] }
|
|
path "totp/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] }
|
|
path "transit/*" { capabilities = ["create", "read", "update", "patch", "delete", "list"] }
|
|
|
|
# Lease management
|
|
path "sys/leases/*" { capabilities = ["create", "read", "update", "delete", "list", "sudo"] }
|
|
|
|
# Operational visibility
|
|
path "sys/health" { capabilities = ["read", "sudo"] }
|
|
path "sys/seal-status" { capabilities = ["read"] }
|
|
path "sys/mounts/+/tune" { capabilities = ["read", "update"] }
|
|
path "sys/capabilities" { capabilities = ["create", "update"] }
|
|
path "sys/capabilities-self" { capabilities = ["create", "update"] }
|
|
|
|
# Allow token self-management
|
|
path "auth/token/lookup-self" { capabilities = ["read"] }
|
|
path "auth/token/renew-self" { capabilities = ["update"] }
|
|
path "auth/token/revoke-self" { capabilities = ["update"] }
|