infrastructure/machines/nixos/storage01/openbao.nix

# SPDX-FileCopyrightText: 2025 Elias Coppens <elias.coppens@dgnum.eu>
#
# SPDX-License-Identifier: EUPL-1.2

{ nixpkgs, ... }:

let
  host = "vault.dgnum.eu";
  port = 3100;
  clusterPort = 3101;
in

{
  services.openbao = {
    enable = true;

    package = nixpkgs.nixos."25.05".openbao;

    settings = {
      listener.tcp = {
        address = "127.0.0.1:${builtins.toString port}";
        cluster_address = "0.0.0.0:${toString clusterPort}";
        tls_disable = true;
      };

      storage.raft = {
        path = "/var/lib/openbao";
        node_id = "storage01";
      };

      cluster_addr = "http://${host}:${toString clusterPort}";
      api_addr = "https://${host}";

      ui = true;
    };
  };

  dgn-web.simpleProxies.openbao = {
    inherit host port;
  };
}