57_WolveandClaude Opus 4.8
b027de2182
An adversarial re-verification of 0812f34 found a couple of the fixes were
incomplete or regressed; addressed here.
- DR was an INCOMPLETE fix: `raft snapshot save`/`restore` are token-gated
(sys/storage/raft/snapshot is sudo-capable) and the container carries no
ambient token, so the previously-"fixed" backup returned "missing client
token" and streamed a zero-byte snapshot. Both the deploy.sh runbook and the
README DR flow now pass `-e BAO_TOKEN=<token>` on save and restore.
- IPv6 bind REGRESSION (introduced by the bind-narrowing): a bare IPv6 literal
in the compose port map (`fd00::10:8200:8200`) is invalid and aborts at
`docker compose pull`. Now IPv4 vs IPv6 are classified separately and IPv6 is
bracketed (`[fd00::10]:8200:8200`).
- Docker readiness race (now reachable since install_docker is actually
called): openrc backgrounds dockerd and returns before the socket is up, so
the next `docker compose pull` raced it under set -e. install_docker now polls
`docker info` for up to 30s.
- UID detection hardened: added `-T` to the one-off `docker compose run`, and an
empty result is now a loud warning (with the manual-chown remedy) instead of a
silent fall-through to root that would re-create the crash-loop on a non-root
image.
- The raft-volume chown is gated to first run (captured before any compose-run
instantiates the volume), so idempotent re-deploys don't recursively re-chown
a live raft dir.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
151 lines
7.0 KiB
Markdown
151 lines
7.0 KiB
Markdown
# openbao
|
|
|
|
Hardened [OpenBao](https://openbao.org) — the tape-encryption key store for
|
|
**Kanrisha** (the LTO tape-archive system; separate repo, separate host).
|
|
Deliberately **separate from the tape host**: a compromise of the tape node must
|
|
not reach the vault, and OpenBao's mlock/TLS/unseal lifecycle is cleaner on its
|
|
own box.
|
|
|
|
Unlike the other stacks here there is **no Caddy / Let's Encrypt** — a secrets
|
|
store terminates TLS itself and is reached over the **LAN**, not the public
|
|
internet.
|
|
|
|
- **Native TLS** on the listener — self-signed by default, or a CA-signed cert
|
|
from your Smallstep CA over ACME.
|
|
- **Integrated raft storage** — snapshot-based DR.
|
|
- **mlock on** — key material never hits swap.
|
|
- **Manual unseal by default**, or PKCS#11 HSM auto-unseal.
|
|
|
|
> ⚠️ This vault is the **sole recovery path for encrypted tapes.** Losing the
|
|
> OpenBao data *and* the unseal keys/root token loses every encrypted tape. Take
|
|
> raft snapshots and store the unseal material out of band (below).
|
|
|
|
## Required `.env` values
|
|
|
|
| Variable | Notes |
|
|
|----------|-------|
|
|
| `OPENBAO_ADDR` | IP/DNS the Kanrisha tape host uses to reach this vault (goes in the cert SAN; you point the daemon at `https://$OPENBAO_ADDR:8200`). |
|
|
| `OPENBAO_BIND` | Host interface the API publishes on. Left at the default, deploy.sh narrows it to `OPENBAO_ADDR` when that is an IP (a published port bypasses the INPUT firewall, so this bind is the real restriction — see [Exposure](#exposure)). |
|
|
| `OPENBAO_TLS_SANS` | **Extra** SANs beyond `OPENBAO_ADDR` + loopback (which deploy.sh always adds). Read from the environment at deploy time — `export` it before running deploy.sh. |
|
|
| `OPENBAO_TAG` | OpenBao image tag (pin it). |
|
|
| `OPENBAO_HSM_PIN` | Only for PKCS#11 auto-unseal. Leave blank for manual unseal. |
|
|
|
|
See [`.env.example`](.env.example) for the full list.
|
|
|
|
## Deploy
|
|
|
|
```bash
|
|
./automations.sh # Deploy on this host → deploy: openbao
|
|
# or, non-interactive:
|
|
OPENBAO_ADDR=10.0.0.10 SKIP_PROMPTS=1 bash deployments/openbao/deploy.sh
|
|
```
|
|
|
|
`deploy.sh` installs Docker, generates a self-signed TLS cert (if none present),
|
|
seeds `.env`, disables swap (for mlock), narrows the API bind to the LAN IP,
|
|
opens `8200/tcp`, aligns file/volume ownership to the container's UID, and brings
|
|
the stack up. OpenBao starts **sealed** — initialise + unseal once (do this
|
|
immediately; an uninitialised vault reachable on the LAN can be init'd by anyone
|
|
who connects):
|
|
|
|
```bash
|
|
docker compose exec -e BAO_ADDR=https://127.0.0.1:8200 openbao \
|
|
bao operator init -tls-skip-verify # prints 5 unseal keys + root token
|
|
docker compose exec -e BAO_ADDR=https://127.0.0.1:8200 openbao \
|
|
bao operator unseal -tls-skip-verify <key> # x3, three different keys
|
|
```
|
|
|
|
**Store the unseal keys + root token out of band** — ideally age-encrypted with
|
|
your backup recipient (`globals/age-pubkey.txt`), never on this host.
|
|
|
|
## TLS
|
|
|
|
- **Self-signed (default):** `deploy.sh` runs [`gen-tls.sh`](gen-tls.sh) to
|
|
create `./tls/tls.{crt,key}` with `OPENBAO_ADDR` in the SAN. Hand `tls.crt` to
|
|
the Kanrisha daemon as `[encryption.openbao].ca_cert`.
|
|
- **Smallstep CA over ACME (option):** issue a cert from your `step-ca` and drop
|
|
it in `./tls` instead — `gen-tls.sh` then no-ops. e.g. with the `step` client:
|
|
|
|
```bash
|
|
step ca certificate "$OPENBAO_ADDR" ./tls/tls.crt ./tls/tls.key \
|
|
--provisioner acme --acme https://ca.lan/acme/acme/directory
|
|
# renew on a timer: step ca renew --daemon ./tls/tls.crt ./tls/tls.key
|
|
```
|
|
|
|
Give the Kanrisha daemon your Smallstep **root** as `ca_cert` (then it
|
|
trusts the vault without `-tls-skip-verify`).
|
|
|
|
## Auto-unseal (optional)
|
|
|
|
Default is manual unseal after each restart. For hands-off restarts, enable the
|
|
`seal "pkcs11"` stanza in [`config.hcl`](config.hcl), mount the PKCS#11 module +
|
|
device into the `openbao` service, and set `OPENBAO_HSM_PIN` in `.env`.
|
|
|
|
## Bootstrap for Kanrisha
|
|
|
|
Once unsealed, enable KV v2 + AppRole and seed the domain key with the Kanrisha
|
|
bootstrap script (from the Kanrisha repo, `deploy/openbao/bootstrap.sh`). It calls
|
|
the `bao` CLI directly, so run it **from a host that has `bao`** (the Kanrisha
|
|
host or your workstation) pointed at this vault — this vault host only ships
|
|
Docker. Copy `tls.crt` to that host first and pass it as `BAO_CACERT`:
|
|
|
|
```bash
|
|
BAO_ADDR=https://$OPENBAO_ADDR:8200 BAO_CACERT=/path/to/openbao-ca.crt \
|
|
BAO_TOKEN=<root> bash bootstrap.sh
|
|
```
|
|
|
|
It enables the `kanrisha-tape` KV-v2 mount (with **effectively-unlimited**
|
|
`max_versions` so a key rotation never orphans old tapes), creates the AppRole +
|
|
policy, seeds the domain key, and prints the `[encryption.openbao]` block for the
|
|
Kanrisha config. Point the daemon at `address = "https://$OPENBAO_ADDR:8200"`.
|
|
|
|
## Exposure
|
|
|
|
This is a secrets store on the LAN, not a public service. Two things to know:
|
|
|
|
- **A Docker-published port is DNAT'd and bypasses the host `INPUT` firewall.** A
|
|
source-restricting rule on `INPUT` does **not** gate `:8200`. The real interface
|
|
restriction is the publish bind: `deploy.sh` defaults `OPENBAO_BIND` to
|
|
`OPENBAO_ADDR` when that is an IP, so the API listens only on that LAN IP. To
|
|
restrict by *source host*, use a `FORWARD`/`DOCKER-USER` rule or network
|
|
segmentation, not `INPUT`.
|
|
- **mTLS (optional):** to require the tape host to present a client cert, enable
|
|
the `tls_require_and_verify_client_cert` stanza in [`config.hcl`](config.hcl)
|
|
and issue the tape host a client cert from the same CA.
|
|
|
|
And **initialise the vault immediately** after `deploy.sh` — an uninitialised
|
|
vault reachable on the LAN can be `bao operator init`'d by anyone who connects,
|
|
handing them the root token and unseal keys.
|
|
|
|
## Backup / DR
|
|
|
|
The vault is the sole recovery path for encrypted tapes — back it up:
|
|
|
|
Snapshot save/restore are **token-gated** (`sys/storage/raft/snapshot` is
|
|
sudo-capable) — pass a token that has that path (the root token works, or mint a
|
|
dedicated snapshot-policy token). The container has no ambient token, so supply
|
|
it via `-e BAO_TOKEN`.
|
|
|
|
```bash
|
|
# Consistent raft snapshot (safe while running); write it to a scratch path, NOT
|
|
# into the live raft dir:
|
|
docker compose exec -T -e BAO_TOKEN=<token> openbao \
|
|
bao operator raft snapshot save -address=https://127.0.0.1:8200 -tls-skip-verify /tmp/openbao.snap
|
|
# then stream the RAW file off-box, age-encrypted. Use `exec -T ... cat`, not
|
|
# `compose cp openbao:… -` (which emits a TAR wrapper that won't restore):
|
|
docker compose exec -T openbao cat /tmp/openbao.snap | \
|
|
age -r "$(cat /path/to/globals/age-pubkey.txt)" > "openbao-$(date +%F).snap.age"
|
|
```
|
|
|
|
Restore (into a fresh, unsealed vault): decrypt, copy the raw `.snap` in, and
|
|
apply it (also token-gated):
|
|
|
|
```bash
|
|
age -d -i ~/.age/key.txt openbao-DATE.snap.age > openbao.snap
|
|
docker compose cp openbao.snap openbao:/tmp/openbao.snap
|
|
docker compose exec -T -e BAO_TOKEN=<token> openbao \
|
|
bao operator raft snapshot restore -address=https://127.0.0.1:8200 -tls-skip-verify /tmp/openbao.snap
|
|
```
|
|
|
|
Snapshots do **not** contain the unseal keys or root token — you still need
|
|
those to unseal a restored vault, which is why they are stored separately.
|