mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
20 lines
1.1 KiB
YAML
20 lines
1.1 KiB
YAML
---
|
|
credentials:
|
|
seal_key:
|
|
description: 32-byte AES-256-GCM-96 key for the OpenBao static seal, injected as env://OPENBAO_SEAL_KEY. Every backup of the raft volume is undecryptable
|
|
without it; its authoritative home is the encrypted inventory. Pinned because the static seal carries only one generation, so a deploy that skips a
|
|
generation, or dies between the two AppRole pins, puts the store outside that window and leaves it recoverable only from a volume backup plus the key that
|
|
wraps it. Rotate it deliberately by changing the inventory value; openbao.hcl.j2 still renders the previous_key pair for that.
|
|
algorithm: random_hex_32
|
|
validation: non_empty_string
|
|
rotatable: false
|
|
approle_role_id:
|
|
description: RoleID of the Ansible AppRole, written to auth/approle/role/ansible/role-id at bootstrap so later deploys authenticate without a stored root
|
|
token.
|
|
algorithm: alphanumeric
|
|
validation: non_empty_string
|
|
approle_secret_id:
|
|
description: SecretID of the Ansible AppRole, written to auth/approle/role/ansible/custom-secret-id at bootstrap.
|
|
algorithm: alphanumeric
|
|
validation: non_empty_string
|