34 lines
1005 B
Django/Jinja
34 lines
1005 B
Django/Jinja
# {{ ansible_managed }} — openbao role. Do not edit by hand.
|
|
ui = {{ openbao_ui | lower }}
|
|
|
|
storage "raft" {
|
|
path = "{{ openbao_data_dir }}"
|
|
node_id = "{{ openbao_node_id }}"
|
|
}
|
|
|
|
listener "tcp" {
|
|
address = "{{ openbao_listen_address }}"
|
|
tls_cert_file = "{{ openbao_tls_dir }}/cert.pem"
|
|
tls_key_file = "{{ openbao_tls_dir }}/key.pem"
|
|
tls_min_version = "tls12"
|
|
}
|
|
|
|
api_addr = "{{ openbao_api_addr }}"
|
|
cluster_addr = "{{ openbao_cluster_addr }}"
|
|
{% if openbao_auto_unseal %}
|
|
|
|
# Auto-unseal via a Transit engine on a separate OpenBao/Vault instance.
|
|
seal "transit" {
|
|
address = "{{ openbao_transit_address }}"
|
|
token = "{{ openbao_transit_token }}"
|
|
key_name = "{{ openbao_transit_key_name }}"
|
|
mount_path = "{{ openbao_transit_mount_path }}"
|
|
}
|
|
{% endif %}
|
|
|
|
# 显式固定 Prometheus 行为；应用此配置会经 handler 重启，须人工解封。
|
|
telemetry {
|
|
prometheus_retention_time = "{{ openbao_prometheus_retention_time }}"
|
|
disable_hostname = true
|
|
}
|