57_WolveandClaude Opus 5
f8c839a163
2.5.5 was two releases behind. Verified against the openbao/openbao source at
tag v2.6.2 that the bump is safe for an existing vault: raft's on-disk format
is unchanged (identical bbolt / hashicorp-raft / raft-boltdb pins,
byte-identical physical/raft/types.proto), snapshots restore in both
directions, and every stanza this config.hcl uses still parses -- the config
parser only moved import paths and the listener diff is additive.
Three corrections that came out of that check.
deploy.sh's printed crash-loop recovery command was already broken by 2.6.0.
That release adds `USER openbao` to the alpine image, so the container no
longer starts as root; the `docker run ... --entrypoint sh ... chown` it tells
the operator to run now executes as uid 100 and fails. Added `--user 0:0`, and
dropped the stale 2.5.5 literal from the same string. The detection logic
itself is unaffected -- `id -u openbao` still reads /etc/passwd and still
returns 100, verified by extracting the passwd layer from both published
images -- so a02524a holds and the volume does not need re-chowning.
The mlock story was wrong, and was already wrong on 2.5.5. OpenBao removed
mlock support: its own config parser carries "OpenBao has dropped support for
mlock. Please remove the line disable_mlock = false from your config and
disable or encrypt swap instead." So `cap_add: [IPC_LOCK]` and
`ulimits: memlock: -1` are inert, and config.hcl's "mlock keeps key material
off swap -- REQUIRED" was describing something that does not happen. The
BEHAVIOUR was right all along, because deploy.sh disables swap, which is the
actual mitigation; only the explanation was wrong. Corrected in config.hcl,
docker-compose.yml and the README. The two compose settings stay: they are
harmless, and removing them would recreate every deployed container for no
gain.
The built-in `seal "pkcs11"` stanza is deprecated in 2.6.0 for removal in
v2.7.0, and the HSM distribution is discontinued by then; PKCS#11 auto-unseal
continues only via the external `plugin "kms" "pkcs11" {}`. Noted where the
commented-out stanza lives, since a stack relying on it has to move before
taking 2.7.x.
Also worth recording and NOT acting on: do not switch to the openbao-distroless
image variant. It ships no shell, which breaks every `docker compose run
--entrypoint sh` probe deploy.sh uses.
Upgrading a LIVE vault is not automatic -- snapshot first, and the restart
comes back sealed. That is the next commit.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
44 lines
2.8 KiB
Bash
44 lines
2.8 KiB
Bash
# Copy to .env and fill in. docker compose picks .env up automatically.
|
|
# deploy.sh seeds .env from this on first run; an existing .env is never
|
|
# overwritten. Never commit the populated .env.
|
|
|
|
# ─── Reachability ───────────────────────────────────────────────────────────
|
|
# Address (IP or DNS name) the KANRISHA tape host uses to reach this vault on
|
|
# the LAN. Seeds the self-signed cert SAN below and is what you point
|
|
# [encryption.openbao].address at (https://${OPENBAO_ADDR}:8200).
|
|
OPENBAO_ADDR=10.0.0.10
|
|
|
|
# Interface the published API port binds to on the host. Leave blank/all and
|
|
# deploy.sh narrows it to OPENBAO_ADDR when that is an IP; set it explicitly to
|
|
# pin a specific LAN IP. (A published port bypasses the host INPUT firewall — see
|
|
# the README — so this bind is the main interface restriction.)
|
|
OPENBAO_BIND=0.0.0.0
|
|
|
|
# ─── TLS ────────────────────────────────────────────────────────────────────
|
|
# EXTRA SANs for the self-signed cert, beyond OPENBAO_ADDR + loopback (which
|
|
# deploy.sh always includes). This is read from the ENVIRONMENT at deploy time,
|
|
# so to add names export it before running deploy.sh, e.g.
|
|
# OPENBAO_TLS_SANS=DNS:vault.lan,IP:10.0.0.11 bash deploy.sh
|
|
# (deploy.sh records the final SAN list back into this .env for reference.) To
|
|
# use a CA-signed cert instead (e.g. Smallstep over ACME), drop tls.crt + tls.key
|
|
# into ./tls and this is ignored — see the README.
|
|
OPENBAO_TLS_SANS=
|
|
OPENBAO_TLS_DAYS=825
|
|
|
|
# ─── Web UI ─────────────────────────────────────────────────────────────────
|
|
# 1 = serve the built-in web UI on the same listener (default), 0 = API only.
|
|
# Not a new exposure: anything that can reach :8200 can already do everything
|
|
# via the API. With the UI on you can initialise and unseal from a browser,
|
|
# which keeps the unseal keys out of a server shell's history.
|
|
OPENBAO_UI=1
|
|
|
|
# ─── Image tag ──────────────────────────────────────────────────────────────
|
|
# Pin for reproducible deploys.
|
|
OPENBAO_TAG=2.6.2
|
|
|
|
# ─── Auto-unseal (optional; default is MANUAL unseal) ───────────────────────
|
|
# Only used when the seal "pkcs11" stanza is enabled in config.hcl (and the HSM
|
|
# module/device is mounted into the container). Otherwise leave blank and unseal
|
|
# manually after each restart.
|
|
OPENBAO_HSM_PIN=
|