infrastructure/machines/nixos/storage01/vault.nix

# SPDX-FileCopyrightText: 2025 Elias Coppens <elias.coppens@dgnum.eu>
#
# SPDX-License-Identifier: EUPL-1.2

let
  host = "vault.dgnum.eu";
  port = 3100;
  clusterPort = 3101;
in
{
  services.openbao = {
    enable = true;
    address = "127.0.0.1:${toString port}";
    storageBackend = "raft";

    settings = {
      listener = {
        tcp.address = "127.0.0.1:${builtins.toString port}";
        cluster_address = "0.0.0.0:${toString clusterPort}";
      };

      storage.raft = {
        path = "/var/lib/raft";
        node_id = "raft_storage01";
      };

      cluster_addr = "http://${host}:${toString clusterPort}";
      api_addr = "https://${host}";
    };
  };

  dgn-web.simpleProxies.openbao = {
    inherit host port;
  };
}