57_WolveandClaude Opus 5
dc9761a668
config.hcl shipped `ui = false`, so there was no UI to reach even with working connectivity. That forces init and unseal through `docker compose exec`, which puts the unseal keys and root token into a server shell's history and scrollback -- the one place they should never be. Make it a substitution point driven by OPENBAO_UI, default on. This adds no exposure: the UI is served on the same listener, and anything that can reach :8200 can already do everything through the API. What it changes is where the unseal material is displayed -- the operator's browser instead of the host. Rendering config.hcl rather than copying it needed three things to be right: - Precedence. OPENBAO_UI passed to a run wins; otherwise the value .env already deploys applies; otherwise the default. Without that, `OPENBAO_UI=0 bash deploy.sh` against an existing node would report success and change nothing. Env-presence is captured before the ":=" default, so an explicit 0 is distinguishable from "not mentioned" and a re-run cannot silently re-enable the UI. A value passed this run is written back to .env. - Reload. A bind-mounted file's CONTENTS are not part of the compose config hash, so `up -d` leaves a changed config.hcl unloaded -- the same trap fixed in copyparty (76d2a09) and simplex (0f22735). Restart only on an actual change, and say loudly that a restart RE-SEALS the vault, because that is not a free action on a running one. - `cmp -s` stays inside an `if` condition; as `cmp -s A B && CONFIG_CHANGED=1` it would trip set -e whenever the files matched. Verified: default renders `ui = true` and seeds .env; an identical re-run reports no change; .env's 0 is honoured when nothing is passed; a passed 1 beats .env's 0 and is written through; a non-boolean value dies. Note for LAN-isolated hosts: the listener publishes on OPENBAO_BIND only, so a browser on another subnet still cannot reach it. The generated cert already carries DNS:localhost + IP:127.0.0.1 in its SANs, so `ssh -L 8200:<bind-addr>:8200` and https://localhost:8200 works against the existing cert without widening the publish. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
44 lines
2.8 KiB
Bash
44 lines
2.8 KiB
Bash
# Copy to .env and fill in. docker compose picks .env up automatically.
|
|
# deploy.sh seeds .env from this on first run; an existing .env is never
|
|
# overwritten. Never commit the populated .env.
|
|
|
|
# ─── Reachability ───────────────────────────────────────────────────────────
|
|
# Address (IP or DNS name) the KANRISHA tape host uses to reach this vault on
|
|
# the LAN. Seeds the self-signed cert SAN below and is what you point
|
|
# [encryption.openbao].address at (https://${OPENBAO_ADDR}:8200).
|
|
OPENBAO_ADDR=10.0.0.10
|
|
|
|
# Interface the published API port binds to on the host. Leave blank/all and
|
|
# deploy.sh narrows it to OPENBAO_ADDR when that is an IP; set it explicitly to
|
|
# pin a specific LAN IP. (A published port bypasses the host INPUT firewall — see
|
|
# the README — so this bind is the main interface restriction.)
|
|
OPENBAO_BIND=0.0.0.0
|
|
|
|
# ─── TLS ────────────────────────────────────────────────────────────────────
|
|
# EXTRA SANs for the self-signed cert, beyond OPENBAO_ADDR + loopback (which
|
|
# deploy.sh always includes). This is read from the ENVIRONMENT at deploy time,
|
|
# so to add names export it before running deploy.sh, e.g.
|
|
# OPENBAO_TLS_SANS=DNS:vault.lan,IP:10.0.0.11 bash deploy.sh
|
|
# (deploy.sh records the final SAN list back into this .env for reference.) To
|
|
# use a CA-signed cert instead (e.g. Smallstep over ACME), drop tls.crt + tls.key
|
|
# into ./tls and this is ignored — see the README.
|
|
OPENBAO_TLS_SANS=
|
|
OPENBAO_TLS_DAYS=825
|
|
|
|
# ─── Web UI ─────────────────────────────────────────────────────────────────
|
|
# 1 = serve the built-in web UI on the same listener (default), 0 = API only.
|
|
# Not a new exposure: anything that can reach :8200 can already do everything
|
|
# via the API. With the UI on you can initialise and unseal from a browser,
|
|
# which keeps the unseal keys out of a server shell's history.
|
|
OPENBAO_UI=1
|
|
|
|
# ─── Image tag ──────────────────────────────────────────────────────────────
|
|
# Pin for reproducible deploys.
|
|
OPENBAO_TAG=2.5.5
|
|
|
|
# ─── Auto-unseal (optional; default is MANUAL unseal) ───────────────────────
|
|
# Only used when the seal "pkcs11" stanza is enabled in config.hcl (and the HSM
|
|
# module/device is mounted into the container). Otherwise leave blank and unseal
|
|
# manually after each restart.
|
|
OPENBAO_HSM_PIN=
|