Add OpenBao LXC installation and update scripts

2026-05-26 15:16:38 +02:00
parent 04eecf06c4
commit 7899d8fd93
2 changed files with 541 additions and 0 deletions
--- a/openbao/README.md
+++ b/openbao/README.md
@@ -0,0 +1,89 @@
+# OpenBao
+
+Automated installation and update script for an [OpenBao](https://openbao.org) secrets-manager
+server running inside an Alpine LXC on Proxmox.
+
+### Features
+
+Single script, automatic mode selection:
+
+| Context                                              | Action                                                                            |
+| ---------------------------------------------------- | --------------------------------------------------------------------------------- |
+| From Proxmox host, no existing OpenBao container     | Detects newest Alpine template, creates LXC, installs `bao` + OpenRC service      |
+| From Proxmox host, OpenBao container already present | Reuses the existing LXC, refreshes packages, upgrades `bao` to the latest release |
+| From inside an LXC, no `bao` binary                  | Installs OpenBao from scratch                                                     |
+| From inside an LXC, `bao` already present            | Updates the binary only (no config / data changes)                                |
+
+The container is identified by hostname **and** the `openbao` tag, so it is
+re-found across reruns even if the CTID was auto-allocated the first time.
+
+### Requirements
+
+- Proxmox VE host with `pveam`, `pct`, `pvesh`, `jq` available
+- Internet access from both the host (template download) and the LXC (binary download)
+- Script must be run as **root** on the Proxmox host (enforced; the Web UI shell qualifies)
+
+### Usage
+
+#### Full install (from Proxmox shell)
+
+```bash
+bash -c "$(curl -fsSL https://gitea.arnodo.fr/Damien/infra-scripts/raw/branch/main/openbao/install.sh)"
+```
+
+Re-running the exact same command later upgrades packages inside the LXC and
+brings the `bao` binary to the latest release, without touching the config or
+the raft data directory.
+
+#### Customisation
+
+Every parameter is exposed as an environment variable:
+
+| Variable           | Default       | Description                                                   |
+| ------------------ | ------------- | ------------------------------------------------------------- |
+| `CTID`             | auto          | Container ID (auto-allocated via `pvesh get /cluster/nextid`) |
+| `OPENBAO_HOSTNAME` | `openbao`     | LXC hostname (also used as raft `node_id`)                    |
+| `TEMPLATE`         | auto-detected | Alpine template; auto-detected from `pveam available`         |
+| `STORAGE`          | `local-lvm`   | Proxmox storage for the LXC root disk                         |
+| `TEMPLATE_STORAGE` | `local`       | Storage where Alpine templates live                           |
+| `CORES`            | `2`           | vCPU cores                                                    |
+| `RAM`              | `1024`        | RAM in MiB                                                    |
+| `DISK`             | `8`           | Root disk size in GB                                          |
+| `BRIDGE`           | `vmbr0`       | Network bridge                                                |
+| `LXC_TAG`          | `openbao`     | Stable tag used to re-discover the container                  |
+| `OPENBAO_VERSION`  | `latest`      | Pin a specific release (e.g. `v2.0.3`) or `latest`            |
+
+```bash
+CTID=210 OPENBAO_HOSTNAME=vault CORES=4 RAM=2048 \
+  bash -c "$(curl -fsSL https://gitea.arnodo.fr/Damien/infra-scripts/raw/branch/feat/lxc-OpenBao/openbao/install.sh)"
+```
+
+#### First-time initialisation
+
+OpenBao starts sealed. Once the LXC is up:
+
+```bash
+pct enter <CTID>
+export VAULT_ADDR=http://127.0.0.1:8200
+bao operator init        # save the unseal keys + root token somewhere safe
+bao operator unseal      # repeat with each key share until unsealed
+```
+
+#### Update (from inside the LXC)
+
+```bash
+curl -fsSL https://gitea.arnodo.fr/Damien/infra-scripts/raw/branch/feat/lxc-OpenBao/openbao/install.sh | bash
+```
+
+The script auto-detects the presence of `/usr/local/bin/bao` and switches to
+update mode. The OpenRC service is stopped, the binary is swapped (the old one
+is kept as `bao.bak.<ts>`), then the service is restarted.
+
+### Architecture
+
+- **OS**: latest Alpine LXC template (auto-detected), unprivileged, `nesting=1`
+- **Binary**: official `bao` release from `github.com/openbao/openbao`, installed in `/usr/local/bin`
+- **Service**: OpenRC, runs as user `openbao`, logs to `/var/log/openbao.log` (rotated daily, 7 days retained)
+- **Config**: `/etc/openbao/config.hcl` — raft storage, TLS disabled (terminate TLS at the reverse proxy), `disable_mlock = true` for unprivileged LXC
+- **Data**: `/var/lib/openbao/data` (raft)
+- **Version tracking**: `/opt/openbao_version.txt` records the currently installed tag for idempotent reruns