@@ -0,0 +37,4 @@
+        enableACME = true;
+        forceSSL = true;
+        location."/" = {
+          proxyPass = "http://127.0.0.1:${toString port}";

@@ -0,0 +2,4 @@
+#
+# SPDX-License-Identifier: EUPL-1.2
+
+_:

@@ -0,0 +4,4 @@
+
+_:
+let
+  domain = "vault.dgnum.eu";

@@ -0,0 +30,4 @@
+      '';
+    };
+
+    services.nginx = {

@@ -0,0 +4,4 @@
+
+{
+  imports = [
+    ./module.nix

@@ -0,0 +10,4 @@
+  ...
+}:
+
+with lib;

@@ -0,0 +14,4 @@
+
+let
+  cfg = config.services.openbao;
+  opt = options.services.openbao;

@@ -0,0 +16,4 @@
+  cfg = config.services.openbao;
+  opt = options.services.openbao;
+
+  configFile = pkgs.writeText "openbao.hcl" ''

@@ -0,0 +64,4 @@
+    services.openbao = {
+      enable = mkEnableOption "OpenBao daemon";
+
+      package = mkOption {

@@ -0,0 +70,4 @@
+        description = "OpenBao package";
+      };
+
+      dev = mkOption {

@@ -0,0 +78,4 @@
+        '';
+      };
+
+      devRootTokenID = mkOption {

@@ -0,0 +93,4 @@
+      };
+
+      tlsCertFile = mkOption {
+        type = types.nullOr types.str;

@@ -0,0 +100,4 @@
+      };
+
+      tlsKeyFile = mkOption {
+        type = types.nullOr types.str;

@@ -0,0 +172,4 @@
+        description = "Extra text appended to {file}`vault.hcl`.";
+      };
+
+      extraSettingsPaths = mkOption {

@@ -0,0 +228,4 @@
+      }
+    ];
+
+    users.users.openbao = {

@@ -0,0 +236,4 @@
+    };
+    users.groups.openbao.gid = config.ids.gids.vault;
+
+    systemd.tmpfiles.rules = optional (

@@ -0,0 +252,4 @@
+
+      startLimitIntervalSec = 60;
+      startLimitBurst = 3;
+      serviceConfig = {

@@ -0,0 +255,4 @@
+      serviceConfig = {
+        User = "openbao";
+        Group = "openbao";
+        ExecStart = "${lib.getExe cfg.package} server ${configOptions}";

@@ -0,0 +256,4 @@
+        User = "openbao";
+        Group = "openbao";
+        ExecStart = "${lib.getExe cfg.package} server ${configOptions}";
+        ExecReload = "${pkgs.coreutils}/bin/kill -SIGHUP $MAINPID";

@@ -0,0 +259,4 @@
+        ExecReload = "${pkgs.coreutils}/bin/kill -SIGHUP $MAINPID";
+        StateDirectory = "vault";
+        # In `dev` mode vault will put its token here
+        Environment = lib.optional cfg.dev "HOME=/var/lib/vault";

@@ -0,0 +48,4 @@
+      echo "complete -C $out/bin/openbao openbao" > openbao.bash
+      installShellCompletion openbao.bash
+    ''
+    + lib.optionalString stdenv.isLinux ''

@@ -0,0 +58,4 @@
+        }
+    '';
+
+  # passthru.tests = { inherit (nixosTests) vault vault-postgresql vault-dev vault-agent; };

@@ -0,0 +8,4 @@
+  clusterPort = 3101;
+in
+{
+  config = {

@@ -0,0 +14,4 @@
+      address = "127.0.0.1:${toString port}";
+      storageBackend = "raft";
+
+      listenerExtraConfig = {

@@ -0,0 +24,4 @@
+    mkPackageOption
+    getExe'
+    ;
+

@@ -0,0 +29,4 @@
+
+  cfg = config.services.openbao;
+
+  jsonFormat = pkgs.formats.json { };

@@ -0,0 +72,4 @@
+
+      package = mkPackageOption pkgs "openbao" { };
+
+      address = mkOption {

@@ -0,0 +121,4 @@
+        description = "The name of the type of storage backend";
+      };
+
+      storagePath = mkOption {

@@ -0,0 +158,4 @@
+        description = "Extra text appended to {file}`vault.json`.";
+      };
+
+      extraSettingsPaths = mkOption {

@@ -0,0 +215,4 @@
+      ] ++ optional (config.services.consul.enable && cfg.storageBackend == "consul") "consul.service";
+
+      restartIfChanged = false; # do not restart on "nixos-rebuild switch". It would seal the storage and disrupt the clients.
+      preStart = genJqSecretsReplacementSnippet configFile "/var/lib/openbao/config.json";

@@ -0,0 +222,4 @@
+      serviceConfig = {
+        DynamicUser = true;
+        ExecStart = escapeSystemdExecArgs [
+          (lib.getExe cfg.package)

@@ -0,0 +224,4 @@
+        ExecStart = escapeSystemdExecArgs [
+          (lib.getExe cfg.package)
+          "server"
+          configOptions

@@ -0,0 +229,4 @@
+        ExecReload = "${getExe' pkgs.coreutils "kill"} -SIGHUP $MAINPID";
+        StateDirectory = "openbao";
+        UMask = "0700";
+        # In `dev` mode vault will put its token here

@@ -37,0 +37,4 @@
+
+    # OpenBAO
+    (local ./nixpkgs/09-init-openbao.patch)
+    (local ./nixpkgs/10-bump-openbao.patch)