infra-scripts/openbao

OpenBao

Automated installation and update script for an OpenBao secrets-manager server running inside an Alpine LXC on Proxmox.

Features

Single script, automatic mode selection:

Context	Action
From Proxmox host, no existing OpenBao container	Detects newest Alpine template, creates LXC, installs bao + OpenRC service
From Proxmox host, OpenBao container already present	Reuses the existing LXC, refreshes packages, upgrades bao to the latest release
From inside an LXC, no bao binary	Installs OpenBao from scratch
From inside an LXC, bao already present	Updates the binary only (no config / data changes)

The container is identified by hostname and the openbao tag, so it is re-found across reruns even if the CTID was auto-allocated the first time.

Requirements

• Proxmox VE host with pveam, pct, pvesh, jq available
• Internet access from both the host (template download) and the LXC (binary download)
• Script must be run as root on the Proxmox host (enforced; the Web UI shell qualifies)

Usage

Full install (from Proxmox shell)

bash -c "$(curl -fsSL https://gitea.arnodo.fr/Damien/infra-scripts/raw/branch/main/openbao/install.sh)"

Re-running the exact same command later upgrades packages inside the LXC and brings the bao binary to the latest release, without touching the config or the raft data directory.

Customisation

Every parameter is exposed as an environment variable:

Variable	Default	Description
CTID	auto	Container ID (auto-allocated via pvesh get /cluster/nextid)
OPENBAO_HOSTNAME	openbao	LXC hostname (also used as raft node_id)
TEMPLATE	auto-detected	Alpine template; auto-detected from pveam available
STORAGE	local-lvm	Proxmox storage for the LXC root disk
TEMPLATE_STORAGE	local	Storage where Alpine templates live
CORES	2	vCPU cores
RAM	1024	RAM in MiB
DISK	8	Root disk size in GB
BRIDGE	vmbr0	Network bridge
LXC_TAG	openbao	Stable tag used to re-discover the container
OPENBAO_VERSION	latest	Pin a specific release (e.g. v2.0.3) or latest

CTID=210 OPENBAO_HOSTNAME=vault CORES=4 RAM=2048 \
  bash -c "$(curl -fsSL https://gitea.arnodo.fr/Damien/infra-scripts/raw/branch/feat/lxc-OpenBao/openbao/install.sh)"

First-time initialisation

OpenBao starts sealed. Once the LXC is up:

pct enter <CTID>
export VAULT_ADDR=http://127.0.0.1:8200
bao operator init        # save the unseal keys + root token somewhere safe
bao operator unseal      # repeat with each key share until unsealed

Update (from inside the LXC)

curl -fsSL https://gitea.arnodo.fr/Damien/infra-scripts/raw/branch/feat/lxc-OpenBao/openbao/install.sh | bash

The script auto-detects the presence of /usr/local/bin/bao and switches to update mode. The OpenRC service is stopped, the binary is swapped (the old one is kept as bao.bak.<ts>), then the service is restarted.

Architecture

• OS: latest Alpine LXC template (auto-detected), unprivileged, nesting=1
• Binary: official bao release from github.com/openbao/openbao, installed in /usr/local/bin
• Service: OpenRC, runs as user openbao, logs to /var/log/openbao.log (rotated daily, 7 days retained)
• Config: /etc/openbao/config.hcl — raft storage, TLS disabled (terminate TLS at the reverse proxy), disable_mlock = true for unprivileged LXC
• Data: /var/lib/openbao/data (raft)
• Version tracking: /opt/openbao_version.txt records the currently installed tag for idempotent reruns