feat(machines/storage01): init openbao

Signed-off-by: Elias Coppens <elias@dgnum.eu>
2025-03-09 00:40:36 +01:00 · 2025-03-09 00:40:36 +01:00 · f8f5478bfb
commit f8f5478bfb
parent 6602379ead
2 changed files with 38 additions and 0 deletions
--- a/machines/nixos/storage01/vault.nix
+++ b/machines/nixos/storage01/vault.nix
@ -0,0 +1,37 @@
+# SPDX-FileCopyrightText: 2025 Elias Coppens <elias.coppens@dgnum.eu>
+#
+# SPDX-License-Identifier: EUPL-1.2
+
+let
+  host = "vault.dgnum.eu";
+  port = 3100;
+  clusterPort = 3101;
+in
+{
+  config = {
+    services.openbao = {
+      enable = true;
+      address = "127.0.0.1:${toString port}";
+      storageBackend = "raft";
+
+      listenerExtraConfig = ''
+        cluster_address = "0.0.0.0:${toString clusterPort}"
+      '';
+
+      storageConfig = ''
+        path = "/var/lib/raft"
+        node_id = "raft_storage01"
+      '';
+
+      extraConfig = ''
+        cluster_addr = "http://${host}:${toString clusterPort}"
+        api_addr = "https://${host}"
+      '';
+    };
+
+    dgn-web.simpleProxies.openbao = {
+      inherit host port;
+    };
+
+  };
+}
--- a/meta/dns.nix
+++ b/meta/dns.nix
@ -110,6 +110,7 @@ let
          "victoria-metrics" # Victoria Metrics
          "videos" # Peertube
          "pub"
+          "vault" # OpenBAO

          # Garage S3
          "*.cdn"