config.hcl shipped `ui = false`, so there was no UI to reach even with working
connectivity. That forces init and unseal through `docker compose exec`, which
puts the unseal keys and root token into a server shell's history and
scrollback -- the one place they should never be.
Make it a substitution point driven by OPENBAO_UI, default on. This adds no
exposure: the UI is served on the same listener, and anything that can reach
:8200 can already do everything through the API. What it changes is where the
unseal material is displayed -- the operator's browser instead of the host.
Rendering config.hcl rather than copying it needed three things to be right:
- Precedence. OPENBAO_UI passed to a run wins; otherwise the value .env already
deploys applies; otherwise the default. Without that, `OPENBAO_UI=0 bash
deploy.sh` against an existing node would report success and change nothing.
Env-presence is captured before the ":=" default, so an explicit 0 is
distinguishable from "not mentioned" and a re-run cannot silently re-enable
the UI. A value passed this run is written back to .env.
- Reload. A bind-mounted file's CONTENTS are not part of the compose config
hash, so `up -d` leaves a changed config.hcl unloaded -- the same trap fixed
in copyparty (76d2a09) and simplex (0f22735). Restart only on an actual
change, and say loudly that a restart RE-SEALS the vault, because that is not
a free action on a running one.
- `cmp -s` stays inside an `if` condition; as `cmp -s A B && CONFIG_CHANGED=1`
it would trip set -e whenever the files matched.
Verified: default renders `ui = true` and seeds .env; an identical re-run
reports no change; .env's 0 is honoured when nothing is passed; a passed 1 beats
.env's 0 and is written through; a non-boolean value dies.
Note for LAN-isolated hosts: the listener publishes on OPENBAO_BIND only, so a
browser on another subnet still cannot reach it. The generated cert already
carries DNS:localhost + IP:127.0.0.1 in its SANs, so
`ssh -L 8200:<bind-addr>:8200` and https://localhost:8200 works against the
existing cert without widening the publish.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
57_WolveandClaude Opus 5
dc9761a668