From 274e728aeb6dce044730ff3655e65c20c9307164 Mon Sep 17 00:00:00 2001 From: Damien Date: Tue, 26 May 2026 17:02:37 +0200 Subject: [PATCH] Update OpenBao README and add MOTD configuration ``` Update environment variable table formatting for readability Fix data directory path formatting in README Add MOTD with OpenBao status and access information ``` --- openbao/README.md | 34 ++++++++++++++++---------------- openbao/install.sh | 48 ++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 65 insertions(+), 17 deletions(-) diff --git a/openbao/README.md b/openbao/README.md index 7740a27..184c629 100644 --- a/openbao/README.md +++ b/openbao/README.md @@ -39,22 +39,22 @@ the raft data directory. Every parameter is exposed as an environment variable: -| Variable | Default | Description | -| ------------------ | ------------- | ------------------------------------------------------------- | -| `CTID` | auto | Container ID (auto-allocated via `pvesh get /cluster/nextid`) | -| `OPENBAO_HOSTNAME` | `openbao` | LXC hostname (also used as raft `node_id`) | -| `TEMPLATE` | auto-detected | Alpine template; auto-detected from `pveam available` | -| `STORAGE` | `local-lvm` | Proxmox storage for the LXC root disk | -| `TEMPLATE_STORAGE` | `local` | Storage where Alpine templates live | -| `CORES` | `2` | vCPU cores | -| `RAM` | `1024` | RAM in MiB | -| `DISK` | `8` | Root disk size in GB | -| `BRIDGE` | `vmbr0` | Network bridge | -| `LXC_TAG` | `openbao` | Stable tag used to re-discover the container | -| `OPENBAO_VERSION` | `latest` | Pin a specific release (e.g. `v2.0.3`) or `latest` | -| `OPENBAO_LISTEN_ADDR` | `127.0.0.1:8200` | TCP listener address. Loopback by default — Tailscale fronts it. | -| `OPENBAO_API_ADDR` | `http://` | Public API URL (used for UI / OIDC redirects). Set to `https://..ts.net` once known. | -| `TS_AUTHKEY` | _(unset)_ | Pre-auth key (generate at ). If unset, finish `tailscale up` manually inside the LXC. | +| Variable | Default | Description | +| --------------------- | ----------------- | -------------------------------------------------------------------------------------------------------------------------------------- | +| `CTID` | auto | Container ID (auto-allocated via `pvesh get /cluster/nextid`) | +| `OPENBAO_HOSTNAME` | `openbao` | LXC hostname (also used as raft `node_id`) | +| `TEMPLATE` | auto-detected | Alpine template; auto-detected from `pveam available` | +| `STORAGE` | `local-lvm` | Proxmox storage for the LXC root disk | +| `TEMPLATE_STORAGE` | `local` | Storage where Alpine templates live | +| `CORES` | `2` | vCPU cores | +| `RAM` | `1024` | RAM in MiB | +| `DISK` | `8` | Root disk size in GB | +| `BRIDGE` | `vmbr0` | Network bridge | +| `LXC_TAG` | `openbao` | Stable tag used to re-discover the container | +| `OPENBAO_VERSION` | `latest` | Pin a specific release (e.g. `v2.0.3`) or `latest` | +| `OPENBAO_LISTEN_ADDR` | `127.0.0.1:8200` | TCP listener address. Loopback by default — Tailscale fronts it. | +| `OPENBAO_API_ADDR` | `http://` | Public API URL (used for UI / OIDC redirects). Set to `https://..ts.net` once known. | +| `TS_AUTHKEY` | _(unset)_ | Pre-auth key (generate at ). If unset, finish `tailscale up` manually inside the LXC. | ```bash CTID=210 OPENBAO_HOSTNAME=vault CORES=4 RAM=2048 \ @@ -119,5 +119,5 @@ is kept as `bao.bak.`), then the service is restarted. - **Service**: OpenRC, runs as user `openbao`, logs to `/var/log/openbao.log` (rotated daily, 7 days retained) - **Network**: listener bound to `127.0.0.1:8200`; **Tailscale** runs in the LXC and acts as the reverse proxy (`tailscale serve --https=443`) - **Config**: `/etc/openbao/config.hcl` — raft storage, TLS disabled on the listener (Tailscale terminates TLS), `disable_mlock = true` for unprivileged LXC -- **Data**: `/var/lib/openbao/data` (raft) +- **Data**: `/var/lib/openbao/data` (raft) - **Version tracking**: `/opt/openbao_version.txt` records the currently installed tag for idempotent reruns diff --git a/openbao/install.sh b/openbao/install.sh index a272793..2a8557c 100755 --- a/openbao/install.sh +++ b/openbao/install.sh @@ -474,6 +474,54 @@ EOF configure_tailscale_proxy + log_info "Configuring MOTD..." + # /etc/profile.d/ runs for every interactive login shell — works for both + # the auto-login tty and Tailscale SSH. Quoted heredoc: every variable is + # resolved at login time, not at install time. + cat > /etc/profile.d/00-openbao.sh <<'MOTD' +TS_FQDN=$(tailscale status --json 2>/dev/null | awk -F'"' ' + /"Self"/ { in_self=1 } + in_self && /"DNSName"/ { gsub(/\.$/, "", $4); print $4; exit } +') +[[ -z "$TS_FQDN" ]] && TS_FQDN="$(hostname).ts.net" + +BAO_VERSION=$(cat /opt/openbao_version.txt 2>/dev/null || echo "unknown") + +# `bao status` exit codes: 0 = unsealed, 2 = sealed, anything else = error. +VAULT_ADDR=http://127.0.0.1:8200 /usr/local/bin/bao status >/dev/null 2>&1 +case $? in + 0) SEAL_STATE="unsealed" ;; + 2) SEAL_STATE="SEALED (run: bao operator unseal)" ;; + *) SEAL_STATE="unreachable" ;; +esac + +echo "" +echo " ___ ____ " +echo " / _ \ _ __ ___ _ __ | __ ) __ _ ___ " +echo "| | | | '_ \ / _ \ '_ \| _ \ / _\` |/ _ \\" +echo "| |_| | |_) | __/ | | | |_) | (_| | (_) |" +echo " \___/| .__/ \___|_| |_|____/ \__,_|\___/" +echo " |_| " +echo "" +echo "OpenBao Secrets Manager (${BAO_VERSION})" +echo "─────────────────────────────────────────" +echo "Access:" +echo " • API (local) : http://127.0.0.1:8200" +echo " • Tailnet : https://${TS_FQDN}" +echo " • Seal status : ${SEAL_STATE}" +echo "" +echo "Useful commands:" +echo " export VAULT_ADDR=http://127.0.0.1:8200" +echo " bao status" +echo " bao operator init # first-time only" +echo " bao operator unseal # after every restart" +echo " rc-service openbao status" +echo " tail -f /var/log/openbao.log" +echo "─────────────────────────────────────────" +echo "" +MOTD + chmod +x /etc/profile.d/00-openbao.sh + log_info "Cleaning up..." rm -rf /var/cache/apk/*