Damien/infra-scripts
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update OpenBao README and add MOTD configuration

Browse Source 
```
Update environment variable table formatting for readability

Fix data directory path formatting in README

Add MOTD with OpenBao status and access information
```
This commit is contained in:
Damien
2026-05-26 17:02:37 +02:00
parent 03d7b13f89
commit 274e728aeb
2 changed files with 65 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

34
openbao/README.md
View File

@@ -39,22 +39,22 @@ the raft data directory.
Every parameter is exposed as an environment variable:
| Variable | Default | Description |
| ------------------ | ------------- | ------------------------------------------------------------- |
| `CTID` | auto | Container ID (auto-allocated via `pvesh get /cluster/nextid`) |
| `OPENBAO_HOSTNAME` | `openbao` | LXC hostname (also used as raft `node_id`) |
| `TEMPLATE` | auto-detected | Alpine template; auto-detected from `pveam available` |
| `STORAGE` | `local-lvm` | Proxmox storage for the LXC root disk |
| `TEMPLATE_STORAGE` | `local` | Storage where Alpine templates live |
| `CORES` | `2` | vCPU cores |
| `RAM` | `1024` | RAM in MiB |
| `DISK` | `8` | Root disk size in GB |
| `BRIDGE` | `vmbr0` | Network bridge |
| `LXC_TAG` | `openbao` | Stable tag used to re-discover the container |
| `OPENBAO_VERSION` | `latest` | Pin a specific release (e.g. `v2.0.3`) or `latest` |
| `OPENBAO_LISTEN_ADDR` | `127.0.0.1:8200` | TCP listener address. Loopback by default — Tailscale fronts it. |
| `OPENBAO_API_ADDR` | `http://<listen>` | Public API URL (used for UI / OIDC redirects). Set to `https://<host>.<tailnet>.ts.net` once known. |
| `TS_AUTHKEY` | _(unset)_ | Pre-auth key (generate at <https://login.tailscale.com/admin/settings/keys>). If unset, finish `tailscale up` manually inside the LXC. |
| Variable | Default | Description |
| --------------------- | ----------------- | -------------------------------------------------------------------------------------------------------------------------------------- |
| `CTID` | auto | Container ID (auto-allocated via `pvesh get /cluster/nextid`) |
| `OPENBAO_HOSTNAME` | `openbao` | LXC hostname (also used as raft `node_id`) |
| `TEMPLATE` | auto-detected | Alpine template; auto-detected from `pveam available` |
| `STORAGE` | `local-lvm` | Proxmox storage for the LXC root disk |
| `TEMPLATE_STORAGE` | `local` | Storage where Alpine templates live |
| `CORES` | `2` | vCPU cores |
| `RAM` | `1024` | RAM in MiB |
| `DISK` | `8` | Root disk size in GB |
| `BRIDGE` | `vmbr0` | Network bridge |
| `LXC_TAG` | `openbao` | Stable tag used to re-discover the container |
| `OPENBAO_VERSION` | `latest` | Pin a specific release (e.g. `v2.0.3`) or `latest` |
| `OPENBAO_LISTEN_ADDR` | `127.0.0.1:8200` | TCP listener address. Loopback by default — Tailscale fronts it. |
| `OPENBAO_API_ADDR` | `http://<listen>` | Public API URL (used for UI / OIDC redirects). Set to `https://<host>.<tailnet>.ts.net` once known. |
| `TS_AUTHKEY` | _(unset)_ | Pre-auth key (generate at <https://login.tailscale.com/admin/settings/keys>). If unset, finish `tailscale up` manually inside the LXC. |
```bash
CTID=210 OPENBAO_HOSTNAME=vault CORES=4 RAM=2048 \
@@ -119,5 +119,5 @@ is kept as `bao.bak.<ts>`), then the service is restarted.
- **Service**: OpenRC, runs as user `openbao`, logs to `/var/log/openbao.log` (rotated daily, 7 days retained)
- **Network**: listener bound to `127.0.0.1:8200`; **Tailscale** runs in the LXC and acts as the reverse proxy (`tailscale serve --https=443`)
- **Config**: `/etc/openbao/config.hcl` — raft storage, TLS disabled on the listener (Tailscale terminates TLS), `disable_mlock = true` for unprivileged LXC
- **Data**: `/var/lib/openbao/data` (raft)
- **Data**: `/var/lib/openbao/data` (raft)
- **Version tracking**: `/opt/openbao_version.txt` records the currently installed tag for idempotent reruns

48
openbao/install.sh
View File

@@ -474,6 +474,54 @@ EOF
configure_tailscale_proxy
log_info "Configuring MOTD..."
# /etc/profile.d/ runs for every interactive login shell — works for both
# the auto-login tty and Tailscale SSH. Quoted heredoc: every variable is
# resolved at login time, not at install time.
cat > /etc/profile.d/00-openbao.sh <<'MOTD'
TS_FQDN=$(tailscale status --json 2>/dev/null | awk -F'"' '
/"Self"/ { in_self=1 }
in_self && /"DNSName"/ { gsub(/\.$/, "", $4); print $4; exit }
')
[[ -z "$TS_FQDN" ]] && TS_FQDN="$(hostname).ts.net"
BAO_VERSION=$(cat /opt/openbao_version.txt 2>/dev/null || echo "unknown")
# `bao status` exit codes: 0 = unsealed, 2 = sealed, anything else = error.
VAULT_ADDR=http://127.0.0.1:8200 /usr/local/bin/bao status >/dev/null 2>&1
case $? in
0) SEAL_STATE="unsealed" ;;
2) SEAL_STATE="SEALED (run: bao operator unseal)" ;;
*) SEAL_STATE="unreachable" ;;
esac
echo ""
echo " ___ ____ "
echo " / _ \ _ __ ___ _ __ | __ ) __ _ ___ "
echo "| | | | '_ \ / _ \ '_ \| _ \ / _\` |/ _ \\"
echo "| |_| | |_) | __/ | | | |_) | (_| | (_) |"
echo " \___/| .__/ \___|_| |_|____/ \__,_|\___/"
echo " |_| "
echo ""
echo "OpenBao Secrets Manager (${BAO_VERSION})"
echo "─────────────────────────────────────────"
echo "Access:"
echo " • API (local) : http://127.0.0.1:8200"
echo " • Tailnet : https://${TS_FQDN}"
echo " • Seal status : ${SEAL_STATE}"
echo ""
echo "Useful commands:"
echo " export VAULT_ADDR=http://127.0.0.1:8200"
echo " bao status"
echo " bao operator init # first-time only"
echo " bao operator unseal # after every restart"
echo " rc-service openbao status"
echo " tail -f /var/log/openbao.log"
echo "─────────────────────────────────────────"
echo ""
MOTD
chmod +x /etc/profile.d/00-openbao.sh
log_info "Cleaning up..."
rm -rf /var/cache/apk/*