panxiao81
88a02ababa
Reorganize the brownfield repository, remove retired and generated artifacts, harden ignore rules, and record the GitOps/IaC redesign.
99 lines
5.2 KiB
YAML
99 lines
5.2 KiB
YAML
---
|
|
# openbao_bootstrap role defaults. Secrets come from group_vars/all/vault.yml.
|
|
|
|
# --- Connection to the running, unsealed bao (local to the host) ---
|
|
openbao_api_port: 8200
|
|
openbao_tls_dir: "/etc/openbao/tls"
|
|
# ⚠ MUST be the hostname, not 127.0.0.1. Since openbao_acme gave bao a real Let's
|
|
# Encrypt cert, that cert carries a DNS SAN only — so a loopback connection dies
|
|
# with "cannot validate certificate for 127.0.0.1 because it doesn't contain any
|
|
# IP SANs". Same trap as dc1's LDAPS cert and as reaching bao on 192.168.10.8.
|
|
# bao1 resolves its own name via the DC (verified: HTTP 200, tls ok).
|
|
openbao_addr: "https://bao.ad.ddupan.top:{{ openbao_api_port }}"
|
|
openbao_token: "{{ lookup('env', 'BAO_TOKEN') }}" # export BAO_TOKEN before running
|
|
openbao_no_log: true # -e openbao_no_log=false to debug
|
|
|
|
# Reusable CLI environment (token-bearing → tasks using it set no_log).
|
|
openbao_cli_env:
|
|
BAO_ADDR: "{{ openbao_addr }}"
|
|
BAO_CACERT: "{{ openbao_tls_dir }}/cert.pem"
|
|
BAO_TOKEN: "{{ openbao_token }}"
|
|
|
|
# --- KV v2 (static agent secrets) ---
|
|
openbao_kv_path: "kv"
|
|
|
|
# --- SSH certificate authority (short-lived agent certs) ---
|
|
openbao_ssh_mount: "ssh-client-signer"
|
|
# Principals allowed at sign time. "*" is permissive — real per-node scoping is the
|
|
# `principals="..."` option on each target's `cert-authority` authorized_keys line.
|
|
# Tighten to an explicit list (e.g. "nodeA,nodeB,ansible") for a second gate.
|
|
openbao_ssh_allowed_users: "*"
|
|
openbao_ssh_default_user: "ansible"
|
|
openbao_ssh_cert_ttl: "5m"
|
|
openbao_ssh_cert_max_ttl: "15m"
|
|
openbao_ssh_ca_pub_path: "/etc/openbao/ssh-ca.pub"
|
|
|
|
# --- OIDC human login via Authelia ---
|
|
openbao_oidc_discovery_url: "https://auth.ddupan.top"
|
|
openbao_oidc_client_id: "openbao"
|
|
openbao_oidc_client_secret: "{{ vault_openbao_oidc_client_secret | default('') }}"
|
|
openbao_oidc_default_role: "admin"
|
|
openbao_oidc_admin_group: "vault-admins" # AD group whose members get the admin policy
|
|
openbao_oidc_redirect_uris:
|
|
- "https://bao.ad.ddupan.top:8200/ui/vault/auth/oidc/oidc/callback"
|
|
- "http://localhost:8250/oidc/callback"
|
|
|
|
# --- Kubernetes auth (in-cluster agents, e.g. hermes) — OFF until inputs are ready ---
|
|
# Was opt-in (false) and had therefore never run — the backend did not exist at all
|
|
# until 2026-07-28. Now ON by default: the External Secrets Operator authenticates
|
|
# through it, so every cluster Secret depends on it. Prerequisites, both satisfied:
|
|
# the cluster CA at openbao_k8s_ca_cert_file, and vault_openbao_k8s_reviewer_jwt.
|
|
openbao_enable_k8s_auth: true
|
|
# The k3s API server, as bao must reach it. NOT the address in your kubeconfig —
|
|
# k3s writes https://127.0.0.1:6443 there, which is meaningless from another host.
|
|
# Was 192.168.10.10 (wrong, nothing listens there); corrected 2026-07-28 after
|
|
# verifying from bao1: curl --cacert /etc/openbao/k8s-ca.crt -> HTTP 401, tls ok.
|
|
openbao_k8s_host: "https://192.168.10.127:6443"
|
|
openbao_k8s_ca_cert_file: "/etc/openbao/k8s-ca.crt" # cluster CA, placed on the bao host
|
|
openbao_k8s_reviewer_jwt: "{{ vault_openbao_k8s_reviewer_jwt | default('') }}"
|
|
openbao_k8s_agent_sa: "ai-agent"
|
|
openbao_k8s_agent_ns: "agents"
|
|
|
|
# --- PKI (internal TLS; can replace the self-signed listener cert) ---
|
|
openbao_pki_mount: "pki"
|
|
openbao_pki_ca_cn: "ddupan.top Internal CA"
|
|
openbao_pki_max_lease_ttl: "87600h" # 10y
|
|
openbao_pki_server_role: "bao-server"
|
|
openbao_pki_allowed_domains: "ad.ddupan.top"
|
|
# GATED: issue bao's own listener cert from this PKI and restart. Off by default so
|
|
# bootstrap never risks the listener. Clients must then trust the PKI CA (printed out).
|
|
openbao_pki_replace_listener_cert: false
|
|
|
|
# --- Raft snapshots (local timer; ship the dir off-box yourself) ---
|
|
openbao_snapshot_dir: "/var/backups/openbao"
|
|
openbao_snapshot_keep: 14
|
|
openbao_snapshot_oncalendar: "*-*-* 02:00:00"
|
|
|
|
# ── Terraform / Ansible ownership boundary ───────────────────────────────
|
|
# TRUE (default) = OpenBao's API-level CONFIGURATION lives in ../terraform:
|
|
# mounts, roles, policies, auth mounts+roles, PKI URLs/ACME. This role then
|
|
# does ONLY what Terraform cannot sensibly own:
|
|
# * the daemon, TLS files, systemd, init/unseal (openbao_deploy role)
|
|
# * ROOT-OF-TRUST KEY MATERIAL — the PKI root CA and the SSH CA signing key.
|
|
# Terraform would treat drift on those as "regenerate", silently
|
|
# invalidating every issued cert and every TrustedUserCAKeys line.
|
|
# * the OIDC client SECRET (Terraform cannot read it back; managing it would
|
|
# put plaintext in tfstate and cause a perpetual diff)
|
|
# * the snapshot token + script + systemd timer (host-level, and a secret)
|
|
#
|
|
# Set FALSE only to bootstrap a brand-new instance entirely from Ansible, or to
|
|
# fall back if Terraform is unavailable. Leaving it FALSE against an instance
|
|
# Terraform manages makes the two overwrite each other on alternate runs.
|
|
#
|
|
# FRESH-INSTALL ORDER when true:
|
|
# 1. ansible-playbook deploy-openbao.yml # daemon, TLS, systemd
|
|
# 2. bao operator init / unseal # manual, PGP-wrapped
|
|
# 3. terraform apply # mounts, roles, policies
|
|
# 4. ansible-playbook bootstrap-openbao.yml # CA material, OIDC secret, snapshots
|
|
openbao_config_managed_by_terraform: true
|