57_WolveandClaude Opus 4.8
0812f345a8
A multi-agent sanity audit of the freshly-merged deployment found four end-to-end blockers (and several smaller issues); all fixed here. HIGH (were blocking): - deploy.sh never called install_docker(), so `docker compose pull` hit command-not-found on any host without Docker. Now called before the compose steps. - The container's server process runs as the image's own (often non-root) user but the mounted config/TLS were root-owned 0640/0600 and the raft volume root-owned -> vault crash-looped, never binding :8200. deploy.sh now detects the image UID after pull and aligns ownership of config.hcl, ./tls and the data volume (a no-op when the image runs as root); config.hcl is installed 0644 (holds no secrets). - Docs told operators to set the daemon key `openbao_ca_cert`, but the Kanrisha daemon's key is `ca_cert` (config.go, mapstructure:"ca_cert"). The wrong key is fatal on strict unmarshal / leaves TLS unverified. Renamed in all 5 places (config.hcl, gen-tls.sh, deploy.sh x2, README). - DR backup used `docker compose cp openbao:… -`, which emits a TAR stream, so the age-encrypted snapshot was tar-wrapped and would not restore. Switched to `docker compose exec -T openbao cat` for the raw bytes, wrote the snapshot to a scratch path (not the live raft dir), and documented the matching restore. MEDIUM: - Swap detection used `swapon --show` (absent on BusyBox) and `\s` (GNU-only) -> silently no-op on Alpine, leaving swap on. Now uses /proc/swaps and [[:space:]] so mlock hardening actually holds on musl. - A Docker-published port bypasses the host INPUT firewall, so the source rule was illusory. deploy.sh now narrows OPENBAO_BIND to OPENBAO_ADDR when it is an IP, the compose/README/.env comments state the reality, and a new Exposure section + an init-immediately warning were added. - Fixed broken ../kanrisha/ and deployments/kanrisha/ links (separate repo). LOW: - OPENBAO_TLS_SANS is now honored (folded into the SAN list from the env). - .gitignore excludes *.snap / *.snap.age. - Bootstrap note clarifies bootstrap.sh needs the `bao` CLI (run it from the Kanrisha host/workstation, not this Docker-only vault host). - README multi-OS count corrected (eight stacks) + automations.sh header lists openbao. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
37 lines
2.3 KiB
Bash
37 lines
2.3 KiB
Bash
# Copy to .env and fill in. docker compose picks .env up automatically.
|
|
# deploy.sh seeds .env from this on first run; an existing .env is never
|
|
# overwritten. Never commit the populated .env.
|
|
|
|
# ─── Reachability ───────────────────────────────────────────────────────────
|
|
# Address (IP or DNS name) the KANRISHA tape host uses to reach this vault on
|
|
# the LAN. Seeds the self-signed cert SAN below and is what you point
|
|
# [encryption.openbao].address at (https://${OPENBAO_ADDR}:8200).
|
|
OPENBAO_ADDR=10.0.0.10
|
|
|
|
# Interface the published API port binds to on the host. Leave blank/all and
|
|
# deploy.sh narrows it to OPENBAO_ADDR when that is an IP; set it explicitly to
|
|
# pin a specific LAN IP. (A published port bypasses the host INPUT firewall — see
|
|
# the README — so this bind is the main interface restriction.)
|
|
OPENBAO_BIND=0.0.0.0
|
|
|
|
# ─── TLS ────────────────────────────────────────────────────────────────────
|
|
# EXTRA SANs for the self-signed cert, beyond OPENBAO_ADDR + loopback (which
|
|
# deploy.sh always includes). This is read from the ENVIRONMENT at deploy time,
|
|
# so to add names export it before running deploy.sh, e.g.
|
|
# OPENBAO_TLS_SANS=DNS:vault.lan,IP:10.0.0.11 bash deploy.sh
|
|
# (deploy.sh records the final SAN list back into this .env for reference.) To
|
|
# use a CA-signed cert instead (e.g. Smallstep over ACME), drop tls.crt + tls.key
|
|
# into ./tls and this is ignored — see the README.
|
|
OPENBAO_TLS_SANS=
|
|
OPENBAO_TLS_DAYS=825
|
|
|
|
# ─── Image tag ──────────────────────────────────────────────────────────────
|
|
# Pin for reproducible deploys.
|
|
OPENBAO_TAG=2.5.5
|
|
|
|
# ─── Auto-unseal (optional; default is MANUAL unseal) ───────────────────────
|
|
# Only used when the seal "pkcs11" stanza is enabled in config.hcl (and the HSM
|
|
# module/device is mounted into the container). Otherwise leave blank and unseal
|
|
# manually after each restart.
|
|
OPENBAO_HSM_PIN=
|