Lutz Finsterle
c5ff1a3fca
Picks up 6 security fixes across 2.6.0/2.6.2, notably GHSA-xp3c-3jw3-4vcr
(LIST bypassing an explicit deny from a wildcard grant).
Checked the 2.6.x breaking changes against this deployment before upgrading:
- Identity-template hardening (+ * / , now rejected in template values):
no {{ }} templating in any policy, and every pki/ssh role has
*_template = false. Unaffected.
- Container default user changed root -> openbao (uid 100): the raft volume
at /openbao/file is already uid 100 and the config bind-mount is
world-readable :ro, so no chown fixup was needed. Both containers now run
as uid=100(openbao). Unaffected.
- Cloud KMS + pkcs11 seals become external plugins in 2.7.0: this uses the
transit seal, which stays built in. Unaffected.
- physical/file deprecated in 2.7.0: storage is raft. Unaffected.
- Pre-v2.5.0 corrupt identity groups purged on unseal: cluster was created
on 2.5.5, and the `family` group survived. Unaffected.
- Arch-specific tags (2.6.x-arm64) no longer published: compose uses the
plain multi-arch tag. Unaffected.
Upgrade order was unsealer first (recreate, manually unseal 1-of-1 shamir,
confirm the autounseal transit key is readable), then main, which
auto-unsealed via transit. Cluster IDs preserved on both.
Verified after: all 13 mounts, 4 auth methods and 14 policies intact; KV
read, PKI issue, SSH CA sign and transit encrypt all work through their
scoped tokens; backup token still 403s outside its scope; raft snapshots
succeed on 2.6.2; HTTPS via Traefik serves 2.6.2 with a trusted chain.
Note: sys/seal-status now reports `commit_date` instead of `build_date`.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NFtVLA7VVqXL5G2S18c4Jk
65 lines
2.0 KiB
YAML
65 lines
2.0 KiB
YAML
services:
|
|
openbao:
|
|
image: openbao/openbao:2.6.2
|
|
container_name: openbao
|
|
restart: unless-stopped
|
|
# The image entrypoint already runs `bao server -config=/openbao/config`
|
|
# (the whole config dir), so we only pass the subcommand here.
|
|
command: server
|
|
ports:
|
|
# Plaintext API bound to loopback only — local CLI/admin use. LAN clients
|
|
# reach OpenBAO via Traefik (TLS) at https://openbao.famfi.home instead.
|
|
- "127.0.0.1:8200:8200"
|
|
environment:
|
|
BAO_ADDR: "http://127.0.0.1:8200"
|
|
networks:
|
|
- default
|
|
- traefik_proxy
|
|
volumes:
|
|
- ./config:/openbao/config:ro
|
|
- openbao-data:/openbao/file
|
|
healthcheck:
|
|
# 200 = unsealed+active. Accept sealed (501) and standby (429) too,
|
|
# so the container is "healthy" once the API is responding at all.
|
|
test: ["CMD", "bao", "status", "-address=http://127.0.0.1:8200"]
|
|
interval: 30s
|
|
timeout: 5s
|
|
retries: 5
|
|
start_period: 10s
|
|
depends_on:
|
|
- openbao-unsealer
|
|
|
|
# Minimal sidecar instance that provides transit auto-unseal for the main
|
|
# node above. Shamir-sealed itself; only reachable on the internal network.
|
|
openbao-unsealer:
|
|
image: openbao/openbao:2.6.2
|
|
container_name: openbao-unsealer
|
|
restart: unless-stopped
|
|
command: server
|
|
# No host port published — only the main node needs it, over the default net.
|
|
environment:
|
|
BAO_ADDR: "http://127.0.0.1:8200"
|
|
networks:
|
|
- default
|
|
volumes:
|
|
- ./config-unsealer:/openbao/config:ro
|
|
- openbao-unsealer-data:/openbao/file
|
|
healthcheck:
|
|
test: ["CMD", "bao", "status", "-address=http://127.0.0.1:8200"]
|
|
interval: 30s
|
|
timeout: 5s
|
|
retries: 5
|
|
start_period: 10s
|
|
|
|
networks:
|
|
# Project-internal network (default).
|
|
default:
|
|
# Shared with the Traefik stack so Traefik can reach this container by name
|
|
# (http://openbao:8200). Created by the Traefik compose project.
|
|
traefik_proxy:
|
|
external: true
|
|
|
|
volumes:
|
|
openbao-data:
|
|
openbao-unsealer-data:
|