Wire Forge-native release infrastructure

nixos/modules/burrow-openbao.nix

@@ -0,0 +1,101 @@
+{ config, lib, ... }:
+
+let
+  cfg = config.services.burrow.openbao;
+in
+{
+  options.services.burrow.openbao = {
+    enable = lib.mkEnableOption "the Burrow OpenBao deployment";
+
+    domain = lib.mkOption {
+      type = lib.types.str;
+      default = "vault.burrow.net";
+      description = "Public OpenBao domain.";
+    };
+
+    listenAddress = lib.mkOption {
+      type = lib.types.str;
+      default = "127.0.0.1";
+      description = "Local OpenBao listener address.";
+    };
+
+    port = lib.mkOption {
+      type = lib.types.port;
+      default = 8200;
+      description = "Local OpenBao API port.";
+    };
+
+    clusterPort = lib.mkOption {
+      type = lib.types.port;
+      default = 8201;
+      description = "Local OpenBao cluster port.";
+    };
+
+    dataDir = lib.mkOption {
+      type = lib.types.str;
+      default = "/var/lib/burrow/openbao";
+      description = "Persistent OpenBao state directory.";
+    };
+
+    googleKmsSeal = {
+      enable = lib.mkEnableOption "Google Cloud KMS seal wrapping";
+
+      project = lib.mkOption {
+        type = lib.types.str;
+        default = "project-88c23ce9-918a-470a-b33";
+        description = "Google Cloud project containing the seal key.";
+      };
+
+      location = lib.mkOption {
+        type = lib.types.str;
+        default = "global";
+        description = "Google Cloud KMS key ring location.";
+      };
+
+      keyRing = lib.mkOption {
+        type = lib.types.str;
+        default = "burrow-identity";
+        description = "Google Cloud KMS key ring name.";
+      };
+
+      cryptoKey = lib.mkOption {
+        type = lib.types.str;
+        default = "openbao-seal";
+        description = "Google Cloud KMS crypto key name used for seal wrapping.";
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.tmpfiles.rules = [
+      "d ${cfg.dataDir} 0700 openbao openbao - -"
+      "d ${cfg.dataDir}/data 0700 openbao openbao - -"
+    ];
+
+    services.openbao = {
+      enable = true;
+      settings = {
+        ui = true;
+        api_addr = "https://${cfg.domain}";
+        cluster_addr = "http://${cfg.listenAddress}:${toString cfg.clusterPort}";
+        storage.file.path = "${cfg.dataDir}/data";
+        listener.tcp = {
+          address = "${cfg.listenAddress}:${toString cfg.port}";
+          tls_disable = true;
+        };
+      } // lib.optionalAttrs cfg.googleKmsSeal.enable {
+        seal.gcpckms = {
+          project = cfg.googleKmsSeal.project;
+          region = cfg.googleKmsSeal.location;
+          key_ring = cfg.googleKmsSeal.keyRing;
+          crypto_key = cfg.googleKmsSeal.cryptoKey;
+        };
+      };
+    };
+
+    services.caddy.virtualHosts."${cfg.domain}".extraConfig = ''
+      encode gzip zstd
+      reverse_proxy ${cfg.listenAddress}:${toString cfg.port}
+    '';
+  };
+}