34 lines
1.3 KiB
HCL
34 lines
1.3 KiB
HCL
ui = true
|
|
|
|
# Integrated Raft storage — self-contained, supports snapshot backups.
|
|
# Path is /openbao/file because that directory is pre-created in the image
|
|
# owned by the unprivileged "openbao" user; a named volume mounted there
|
|
# inherits that ownership and is writable after the entrypoint drops root.
|
|
storage "raft" {
|
|
path = "/openbao/file"
|
|
node_id = "openbao-node-1"
|
|
}
|
|
|
|
# API listener. TLS is disabled here for an initial home-lab setup; the
|
|
# expectation is that a reverse proxy (Caddy/Traefik/nginx) terminates TLS,
|
|
# or you enable native TLS below. Do NOT expose this port to the internet
|
|
# without TLS in front of it.
|
|
listener "tcp" {
|
|
address = "0.0.0.0:8200"
|
|
tls_disable = 1
|
|
|
|
# To enable native TLS instead of a reverse proxy:
|
|
# tls_disable = 0
|
|
# tls_cert_file = "/openbao/config/tls/cert.pem"
|
|
# tls_key_file = "/openbao/config/tls/key.pem"
|
|
}
|
|
|
|
# Advertised addresses. api_addr is the external URL clients/UI use — here the
|
|
# Traefik-fronted HTTPS name. cluster_addr is for Raft peer traffic (single node).
|
|
api_addr = "https://openbao.famfi.home"
|
|
cluster_addr = "https://openbao:8201"
|
|
|
|
# NOTE: OpenBAO 2.x removed mlock support. Instead, disable or encrypt swap
|
|
# on the host so secrets can't leak to disk. See:
|
|
# https://openbao.org/docs/install/#post-installation-hardening
|