Lutz Finsterle
f2919cf50a
Periodic scoped tokens (~/.config/openbao/*.token) expired because nothing renewed them within their period. renew-app-tokens.sh renews all of them via auth/token/renew-self; openbao-token-renew.timer runs it daily (Persistent=true). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
30 lines
1.3 KiB
Bash
Executable File
30 lines
1.3 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Renew every scoped OpenBAO app token so periodic tokens never lapse. Periodic
|
|
# tokens live only as long as they're renewed within their period; nothing was
|
|
# renewing these, so they expired (2026-08-01). Runs daily via a systemd timer.
|
|
#
|
|
# Best-effort: reads each ~/.config/openbao/*.token and calls renew-self. A dead
|
|
# token logs a failure but never aborts the rest. No secrets are printed.
|
|
set -uo pipefail
|
|
ADDR="${BAO_ADDR:-http://127.0.0.1:8200}"
|
|
DIR="$HOME/.config/openbao"
|
|
LOG="$DIR/token-renew.log"
|
|
ts="$(date '+%F %T %Z')"
|
|
shopt -s nullglob
|
|
|
|
renewed=0; failed=0
|
|
for tf in "$DIR"/*.token; do # *.token only — backup files (*.token.bak.*) don't match
|
|
tok="$(cat "$tf" 2>/dev/null)"
|
|
name="$(basename "$tf")"
|
|
[ -n "$tok" ] || { echo "$ts $name EMPTY" >> "$LOG"; failed=$((failed+1)); continue; }
|
|
resp="$(curl -sS --max-time 10 -H "X-Vault-Token: $tok" -X POST "$ADDR/v1/auth/token/renew-self" 2>/dev/null)"
|
|
ttl="$(printf '%s' "$resp" | jq -r '.auth.lease_duration // empty' 2>/dev/null)"
|
|
if [ -n "$ttl" ]; then
|
|
echo "$ts $name renewed ttl=${ttl}s" >> "$LOG"; renewed=$((renewed+1))
|
|
else
|
|
echo "$ts $name RENEW FAILED: $(printf '%s' "$resp" | jq -c '.errors // .' 2>/dev/null)" >> "$LOG"; failed=$((failed+1))
|
|
fi
|
|
done
|
|
echo "$ts summary: renewed=$renewed failed=$failed" >> "$LOG"
|
|
[ "$failed" -eq 0 ]
|