hackclub/burrow
1
0
Fork 0
Code Pull requests Releases Packages Activity Actions
burrow/infra/openbao/README.md
Conrad Kramer 002bd382e9
Some checks failed
Cache: Publish Nix / Publish Nix Cache (push) Waiting to run
Details
Build Rust / Cargo Test (push) Successful in 4m14s
Details
Build Site / Next.js Build (push) Failing after 6s
Details
Infra: OpenTofu / OpenTofu (grafana) (push) Successful in 5s
Details
Lint Governance / BEP Metadata (push) Successful in 0s
Details
Build: Android / Android Rust Core Stub (push) Failing after 23s
Details
Wire Forge-native release infrastructure
2026-06-07 05:51:12 -07:00

876 B
Raw Blame History

Burrow OpenBao Control Plane

This OpenTofu stack manages non-secret infrastructure around vault.burrow.net.

It may manage:

  • Google KMS seal-wrapping keys for OpenBao
  • the OpenBao age/ KV v2 mount used for migrated runtime secrets
  • OpenBao policies and Authentik OIDC roles
  • AppRole auth scaffolding for machine consumers

It must not manage:

  • secret values
  • root tokens
  • AppRole SecretIDs
  • release-signing key material

Run

Scripts/openbao-tofu.sh init -backend-config=backend.hcl
Scripts/openbao-tofu.sh plan -var-file=terraform.tfvars

For local syntax work:

Scripts/openbao-tofu.sh init -backend=false
Scripts/openbao-tofu.sh validate

The Vault/OpenBao provider reads VAULT_TOKEN from the environment. Keep manage_openbao_config = false until vault.burrow.net is initialized and an operator token is available out of band.