002bd382e9
Some checks failed
Cache: Publish Nix / Publish Nix Cache (push) Waiting to run
Build Rust / Cargo Test (push) Successful in 4m14s
Build Site / Next.js Build (push) Failing after 6s
Infra: OpenTofu / OpenTofu (grafana) (push) Successful in 5s
Lint Governance / BEP Metadata (push) Successful in 0s
Build: Android / Android Rust Core Stub (push) Failing after 23s
36 lines
876 B
Markdown
36 lines
876 B
Markdown
# Burrow OpenBao Control Plane
|
|
|
|
This OpenTofu stack manages non-secret infrastructure around
|
|
`vault.burrow.net`.
|
|
|
|
It may manage:
|
|
|
|
- Google KMS seal-wrapping keys for OpenBao
|
|
- the OpenBao `age/` KV v2 mount used for migrated runtime secrets
|
|
- OpenBao policies and Authentik OIDC roles
|
|
- AppRole auth scaffolding for machine consumers
|
|
|
|
It must not manage:
|
|
|
|
- secret values
|
|
- root tokens
|
|
- AppRole SecretIDs
|
|
- release-signing key material
|
|
|
|
## Run
|
|
|
|
```sh
|
|
Scripts/openbao-tofu.sh init -backend-config=backend.hcl
|
|
Scripts/openbao-tofu.sh plan -var-file=terraform.tfvars
|
|
```
|
|
|
|
For local syntax work:
|
|
|
|
```sh
|
|
Scripts/openbao-tofu.sh init -backend=false
|
|
Scripts/openbao-tofu.sh validate
|
|
```
|
|
|
|
The Vault/OpenBao provider reads `VAULT_TOKEN` from the environment. Keep
|
|
`manage_openbao_config = false` until `vault.burrow.net` is initialized and an
|
|
operator token is available out of band.
|