panxiao81
88a02ababa
Reorganize the brownfield repository, remove retired and generated artifacts, harden ignore rules, and record the GitOps/IaC redesign.
27 lines
966 B
YAML
27 lines
966 B
YAML
---
|
|
# Bootstrap a running, INITIALIZED + UNSEALED OpenBao: enable engines/auth/policies.
|
|
# Idempotent — safe to re-run. Authenticates with a token you export after decrypting
|
|
# the PGP-wrapped root token:
|
|
#
|
|
# echo "<encrypted-root-token-b64>" | base64 -d | gpg -dq # touch YubiKey
|
|
# export BAO_TOKEN=<that-plaintext-root-token>
|
|
# ansible-playbook bootstrap-openbao.yml --ask-vault-pass
|
|
#
|
|
# Run selectively with tags: --tags kv,ssh_ca,oidc,pki,k8s,policies,snapshots,verify
|
|
# Debug a step by disabling no_log: -e openbao_no_log=false
|
|
#
|
|
# After bootstrap, create a scoped admin token/OIDC login and REVOKE the root token:
|
|
# bao token revoke -self
|
|
- name: Bootstrap OpenBao (engines, auth, policies)
|
|
hosts: openbao
|
|
become: true
|
|
gather_facts: true
|
|
roles:
|
|
- role: openbao_bootstrap
|
|
post_tasks:
|
|
- name: Smoke tests
|
|
ansible.builtin.import_role:
|
|
name: openbao_bootstrap
|
|
tasks_from: verify.yml
|
|
tags: [verify, never]
|