57_WolveandClaude Opus 4.8
2efc9dbffb
A dedicated OpenBao deployment, kept OFF the Kanrisha tape host so a compromise of the tape node can't reach the vault. - Native TLS on the listener (self-signed by default via gen-tls.sh, or a CA-signed cert from a Smallstep CA over ACME) — no Caddy/Let's Encrypt; reached over the LAN, not the public internet. - Integrated raft storage (clean snapshot-based DR). - mlock on (cap_add IPC_LOCK + memlock unlimited + host swapoff in deploy.sh). - Manual unseal by default; optional PKCS#11 HSM auto-unseal. - deploy.sh: Docker install (Alpine/Debian/Alma), self-signed cert, .env seed, swapoff, firewall 8200/tcp, compose up; then prints init/unseal + the KV-v2 + AppRole bootstrap for Kanrisha + the raft-snapshot DR flow. Self-contained (config payload embedded by build.sh). - Registered in automations.sh + the README deployment table. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
38 lines
1.4 KiB
YAML
38 lines
1.4 KiB
YAML
#cloud-config
|
|
#
|
|
# OpenBao (Kanrisha tape-encryption key store) — harden SSH, then deploy, on a
|
|
# fresh Alpine/Debian/Alma host on the SAME LAN as the Kanrisha tape host.
|
|
#
|
|
# Fill in REPO_URL and the values in the runcmd block, then paste this as the
|
|
# instance user-data. No public DNS / 80 / 443 needed — this is a LAN vault with
|
|
# native TLS on 8200. After boot, initialise + unseal once (see the README).
|
|
|
|
packages:
|
|
- git
|
|
|
|
runcmd:
|
|
- hostnamectl set-hostname openbao || true
|
|
- |
|
|
set -e
|
|
REPO_URL=https://git.anomalous.dev/57_Wolve/automations.git
|
|
REPO_BRANCH=main
|
|
HARDEN_SSH=1 # harden SSH on this fresh VM (set 0 to skip)
|
|
SSH_PORT=22
|
|
ALLOWED_IP= # optional: whitelist your client IP in sshguard
|
|
git clone --depth 1 --branch "$REPO_BRANCH" "$REPO_URL" /opt/automations
|
|
cd /opt/automations
|
|
|
|
# Harden SSH: PQ KEX, key-only auth, sshguard. Seeds root from
|
|
# globals/authorized_keys (or SSH_KEYS_URL).
|
|
if [ "$HARDEN_SSH" = 1 ]; then
|
|
SSH_PORT="$SSH_PORT" ALLOWED_IP="$ALLOWED_IP" SKIP_PROMPTS=1 FORCE=1 \
|
|
bash scripts/harden-ssh.sh
|
|
fi
|
|
|
|
# Deploy OpenBao. OPENBAO_ADDR is the LAN address the Kanrisha tape host
|
|
# reaches this vault at — it goes in the TLS cert SAN. deploy.sh disables
|
|
# swap (for mlock) and firewalls 8200/tcp.
|
|
OPENBAO_ADDR=10.0.0.10 \
|
|
SKIP_PROMPTS=1 \
|
|
bash deployments/openbao/deploy.sh
|