# OpenBao stack — hardened tape-encryption key store for Kanrisha.
#
# Topology (same-LAN, NO reverse proxy):
#   Kanrisha tape host --https--> openbao:8200   (native TLS on the vault itself)
#
# Unlike the other stacks in this repo there is no Caddy / Let's Encrypt: a
# secrets store terminates TLS itself and is reached over the LAN, not the
# public internet. TLS is a self-signed cert (deploy.sh generates it) or a
# CA-signed pair you drop in ./tls (e.g. via your Smallstep CA over ACME).

name: openbao

volumes:
  openbao-data:      # raft integrated storage — the vault's persistent state

services:
  openbao:
    image: openbao/openbao:${OPENBAO_TAG:-2.5.5}
    container_name: openbao
    command: server -config=/openbao/config/config.hcl
    restart: unless-stopped
    # mlock: keep key material off swap. IPC_LOCK + unlimited memlock let the
    # process lock its memory; the HOST must also have swap disabled.
    cap_add:
      - IPC_LOCK
    ulimits:
      memlock: -1
    ports:
      # Native-TLS API. Publish on the LAN IP only (OPENBAO_BIND) so it is not
      # exposed on unrelated interfaces. NOTE: a Docker-published port is DNAT'd
      # and bypasses the host INPUT firewall, so a source restriction there does
      # NOT gate it — narrow access with OPENBAO_BIND + the optional mTLS
      # (tls_require_and_verify_client_cert) stanza in config.hcl, and initialise
      # the vault immediately (an uninitialised vault can be init'd by anyone who
      # can reach it). deploy.sh defaults OPENBAO_BIND to OPENBAO_ADDR when it is
      # an IP.
      - "${OPENBAO_BIND:-0.0.0.0}:8200:8200"
    volumes:
      - ./config.hcl:/openbao/config/config.hcl:ro
      - ./tls:/openbao/tls:ro
      - openbao-data:/openbao/data
    environment:
      # PKCS#11 auto-unseal PIN — only read when the seal "pkcs11" stanza is
      # enabled in config.hcl. Harmless (unused) otherwise.
      BAO_HSM_PIN: "${OPENBAO_HSM_PIN:-}"
      # HA / multi-node only: advertise this node's reachable LAN address.
      # BAO_API_ADDR: "https://${OPENBAO_ADDR}:8200"
      # BAO_CLUSTER_ADDR: "https://${OPENBAO_ADDR}:8201"
    # 0 = unsealed (healthy); 2 = sealed -> unhealthy so a node needing an unseal
    # is visible. -tls-skip-verify because the listener may use a self-signed cert.
    healthcheck:
      test: ["CMD", "bao", "status", "-address=https://127.0.0.1:8200", "-tls-skip-verify"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 10s