DGNum/infrastructure
9
6
Fork 3
Code Issues 27 Pull requests 29 Projects 1 Releases Packages Wiki Activity Actions

fix(openbao): Correctly use UMask feature, tcp listener and genJqScript

Browse source
This commit is contained in:
Tom Hubrecht 2025-03-13 16:04:39 +01:00
parent f1e92c01c7
commit 19ec8d2bab
Signed by: thubrecht
SSH key fingerprint: SHA256:r+nK/SIcWlJ0zFZJGHtlAoRwq1Rm+WcKAm5ADYMoQPc
2 changed files with 6 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

7
machines/nixos/storage01/openbao.nix
View file

@ -13,13 +13,14 @@ in
enable = true; enable = true;
settings = { settings = {
listener = { listener.tcp = {
tcp.address = "127.0.0.1:${builtins.toString port}"; address = "127.0.0.1:${builtins.toString port}";
cluster_address = "0.0.0.0:${toString clusterPort}"; cluster_address = "0.0.0.0:${toString clusterPort}";
tls_disable = true;
}; };
storage.raft = { storage.raft = {
path = "/var/lib/openbao/raft"; path = "/var/lib/openbao";
node_id = "storage01"; node_id = "storage01";
}; };

4
modules/nixos/openbao/default.nix
View file

@ -81,7 +81,7 @@ in
) "consul.service"; ) "consul.service";
restartIfChanged = false; # do not restart on "nixos-rebuild switch". It would seal the storage and disrupt the clients. restartIfChanged = false; # do not restart on "nixos-rebuild switch". It would seal the storage and disrupt the clients.
preStart = genJqSecretsReplacementSnippet (settingsFormat.generate "openbao-settings.json" cfg.settings) "/var/lib/openbao/config.json"; preStart = genJqSecretsReplacementSnippet cfg.settings "/var/lib/openbao/config.json";
startLimitIntervalSec = 60; startLimitIntervalSec = 60;
startLimitBurst = 3; startLimitBurst = 3;
@ -98,7 +98,7 @@ in
); );
ExecReload = "${getExe' pkgs.coreutils "kill"} -SIGHUP $MAINPID"; ExecReload = "${getExe' pkgs.coreutils "kill"} -SIGHUP $MAINPID";
StateDirectory = "openbao"; StateDirectory = "openbao";
UMask = "0700"; UMask = "0077";
AmbientCapabilities = "cap_ipc_lock"; AmbientCapabilities = "cap_ipc_lock";
KillSignal = "SIGINT"; KillSignal = "SIGINT";
LimitCORE = 0; LimitCORE = 0;