History

Conrad Kramer 002bd382e9 Some checks failed Cache: Publish Nix / Publish Nix Cache (push) Waiting to run Details Build Rust / Cargo Test (push) Successful in 4m14s Details Build Site / Next.js Build (push) Failing after 6s Details Infra: OpenTofu / OpenTofu (grafana) (push) Successful in 5s Details Lint Governance / BEP Metadata (push) Successful in 0s Details Build: Android / Android Rust Core Stub (push) Failing after 23s Details Wire Forge-native release infrastructure		2026-06-07 05:51:12 -07:00
..
.gitignore	Wire Forge-native release infrastructure	2026-06-07 05:51:12 -07:00
.terraform.lock.hcl	Wire Forge-native release infrastructure	2026-06-07 05:51:12 -07:00
backend.hcl.example	Wire Forge-native release infrastructure	2026-06-07 05:51:12 -07:00
google.tf	Wire Forge-native release infrastructure	2026-06-07 05:51:12 -07:00
openbao.tf	Wire Forge-native release infrastructure	2026-06-07 05:51:12 -07:00
outputs.tf	Wire Forge-native release infrastructure	2026-06-07 05:51:12 -07:00
providers.tf	Wire Forge-native release infrastructure	2026-06-07 05:51:12 -07:00
README.md	Wire Forge-native release infrastructure	2026-06-07 05:51:12 -07:00
terraform.tfvars.example	Wire Forge-native release infrastructure	2026-06-07 05:51:12 -07:00
variables.tf	Wire Forge-native release infrastructure	2026-06-07 05:51:12 -07:00
versions.tf	Wire Forge-native release infrastructure	2026-06-07 05:51:12 -07:00

README.md

Burrow OpenBao Control Plane

This OpenTofu stack manages non-secret infrastructure around vault.burrow.net.

It may manage:

Google KMS seal-wrapping keys for OpenBao
the OpenBao age/ KV v2 mount used for migrated runtime secrets
OpenBao policies and Authentik OIDC roles
AppRole auth scaffolding for machine consumers

It must not manage:

secret values
root tokens
AppRole SecretIDs
release-signing key material

Run

Scripts/openbao-tofu.sh init -backend-config=backend.hcl
Scripts/openbao-tofu.sh plan -var-file=terraform.tfvars

For local syntax work:

Scripts/openbao-tofu.sh init -backend=false
Scripts/openbao-tofu.sh validate

The Vault/OpenBao provider reads VAULT_TOKEN from the environment. Keep manage_openbao_config = false until vault.burrow.net is initialized and an operator token is available out of band.