57_WolveandClaude Opus 4.8
0812f345a8
A multi-agent sanity audit of the freshly-merged deployment found four end-to-end blockers (and several smaller issues); all fixed here. HIGH (were blocking): - deploy.sh never called install_docker(), so `docker compose pull` hit command-not-found on any host without Docker. Now called before the compose steps. - The container's server process runs as the image's own (often non-root) user but the mounted config/TLS were root-owned 0640/0600 and the raft volume root-owned -> vault crash-looped, never binding :8200. deploy.sh now detects the image UID after pull and aligns ownership of config.hcl, ./tls and the data volume (a no-op when the image runs as root); config.hcl is installed 0644 (holds no secrets). - Docs told operators to set the daemon key `openbao_ca_cert`, but the Kanrisha daemon's key is `ca_cert` (config.go, mapstructure:"ca_cert"). The wrong key is fatal on strict unmarshal / leaves TLS unverified. Renamed in all 5 places (config.hcl, gen-tls.sh, deploy.sh x2, README). - DR backup used `docker compose cp openbao:… -`, which emits a TAR stream, so the age-encrypted snapshot was tar-wrapped and would not restore. Switched to `docker compose exec -T openbao cat` for the raw bytes, wrote the snapshot to a scratch path (not the live raft dir), and documented the matching restore. MEDIUM: - Swap detection used `swapon --show` (absent on BusyBox) and `\s` (GNU-only) -> silently no-op on Alpine, leaving swap on. Now uses /proc/swaps and [[:space:]] so mlock hardening actually holds on musl. - A Docker-published port bypasses the host INPUT firewall, so the source rule was illusory. deploy.sh now narrows OPENBAO_BIND to OPENBAO_ADDR when it is an IP, the compose/README/.env comments state the reality, and a new Exposure section + an init-immediately warning were added. - Fixed broken ../kanrisha/ and deployments/kanrisha/ links (separate repo). LOW: - OPENBAO_TLS_SANS is now honored (folded into the SAN list from the env). - .gitignore excludes *.snap / *.snap.age. - Bootstrap note clarifies bootstrap.sh needs the `bao` CLI (run it from the Kanrisha host/workstation, not this Docker-only vault host). - README multi-OS count corrected (eight stacks) + automations.sh header lists openbao. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
40 lines
1.6 KiB
Bash
40 lines
1.6 KiB
Bash
#!/usr/bin/env bash
|
|
#
|
|
# gen-tls.sh — generate a self-signed TLS cert + key for the OpenBao listener,
|
|
# if one is not already present. Never overwrites existing files, so to use a
|
|
# CA-signed cert (e.g. issued by your Smallstep CA over ACME) just drop tls.crt +
|
|
# tls.key into the target dir instead and this becomes a no-op.
|
|
#
|
|
# Usage: bash gen-tls.sh [TLS_DIR] (default ./tls)
|
|
# Env: OPENBAO_TLS_SANS comma SAN list, e.g. "DNS:vault.lan,IP:10.0.0.10,IP:127.0.0.1"
|
|
# OPENBAO_TLS_DAYS validity in days (default 825 — the max browsers accept)
|
|
|
|
set -euo pipefail
|
|
|
|
DIR="${1:-./tls}"
|
|
SANS="${OPENBAO_TLS_SANS:-DNS:localhost,IP:127.0.0.1}"
|
|
DAYS="${OPENBAO_TLS_DAYS:-825}"
|
|
|
|
mkdir -p "$DIR"
|
|
|
|
if [[ -f "$DIR/tls.crt" && -f "$DIR/tls.key" ]]; then
|
|
echo "[gen-tls] TLS material already present in $DIR — leaving it alone."
|
|
exit 0
|
|
fi
|
|
|
|
command -v openssl >/dev/null 2>&1 || { echo "[gen-tls] openssl not found" >&2; exit 1; }
|
|
|
|
# ECDSA P-256 self-signed cert. The SAN must include every address the tape host
|
|
# (and CLI) use to reach the vault, or their TLS verification fails.
|
|
openssl req -x509 -newkey ec -pkeyopt ec_paramgen_curve:prime256v1 -nodes \
|
|
-keyout "$DIR/tls.key" -out "$DIR/tls.crt" -days "$DAYS" \
|
|
-subj "/CN=openbao" -addext "subjectAltName=${SANS}"
|
|
|
|
chmod 600 "$DIR/tls.key"
|
|
chmod 644 "$DIR/tls.crt"
|
|
|
|
echo "[gen-tls] Generated self-signed OpenBao cert in $DIR"
|
|
echo "[gen-tls] SANs: ${SANS} validity: ${DAYS}d"
|
|
echo "[gen-tls] Give $DIR/tls.crt to the Kanrisha daemon as"
|
|
echo "[gen-tls] [encryption.openbao].ca_cert (so it trusts this listener)."
|