OpenBAO/systemd/openbao-cert-renew.timer at 14f46e108278cf18e88b6e789b512ff6aecf559d - OpenBAO - Gitea: Git with a cup of tea

lutz/OpenBAO

Files

Lutz Finsterle 14f46e1082 Add unsealer, internal CA/TLS, auto-unseal, and automated cert+backup

Build out the home-lab OpenBAO deployment beyond the basic node:

- docker-compose: add openbao-unsealer sidecar; main node now transit
  auto-unseals against it (seal config kept in gitignored config/seal.hcl)
- policies/admin.hcl: non-root admin policy; per-engine rules for
  ssh/pki/pki_int/totp/transit
- Internal two-tier CA (pki/ root + pki_int/ intermediate) issues the
  openbao.famfi.home leaf Traefik serves; root CA published under ca/
- scripts/ + systemd/: daily cert renewal and Raft snapshot backups
  (both instances), with scoped tokens stored outside the repo
- README: full runbook (auto-unseal, PKI, renewal, backups, DR/restore)

Secrets (init/unsealer keys, tokens, seal stanza) stay gitignored.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-06-28 14:28:49 +02:00

11 lines

171 B

SYSTEMD

Raw Blame History

 [Unit]
 Description=Daily check/renew of the openbao.famfi.home leaf cert
 [Timer]
 OnCalendar=daily
 Persistent=true
 RandomizedDelaySec=1h
 [Install]
 WantedBy=timers.target