OpenBAO/systemd/openbao-backup.service at 14f46e108278cf18e88b6e789b512ff6aecf559d - OpenBAO - Gitea: Git with a cup of tea

lutz/OpenBAO

Files

Lutz Finsterle 14f46e1082 Add unsealer, internal CA/TLS, auto-unseal, and automated cert+backup

Build out the home-lab OpenBAO deployment beyond the basic node:

- docker-compose: add openbao-unsealer sidecar; main node now transit
  auto-unseals against it (seal config kept in gitignored config/seal.hcl)
- policies/admin.hcl: non-root admin policy; per-engine rules for
  ssh/pki/pki_int/totp/transit
- Internal two-tier CA (pki/ root + pki_int/ intermediate) issues the
  openbao.famfi.home leaf Traefik serves; root CA published under ca/
- scripts/ + systemd/: daily cert renewal and Raft snapshot backups
  (both instances), with scoped tokens stored outside the repo
- README: full runbook (auto-unseal, PKI, renewal, backups, DR/restore)

Secrets (init/unsealer keys, tokens, seal stanza) stay gitignored.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-06-28 14:28:49 +02:00

10 lines

274 B

Desktop File

Raw Blame History

 [Unit]
 Description=Raft snapshot backup of both OpenBAO instances (main + unsealer)
 After=network-online.target docker.service
 Wants=network-online.target
 Requires=docker.service
 [Service]
 Type=oneshot
 ExecStart=/home/lutz/Projects/OpenBAO/scripts/backup-raft-snapshots.sh