mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 19:01:54 +00:00
kevinveenbirkenbachandClaude Opus 5.5
c925150848
OpenBao 2.7 removed the builtin LDAP auth engine from the server binary (openbao/openbao GH-3882). `bao auth enable ldap` answered "plugin not found in the catalog: ldap" and the deploy stopped there. The role now builds its own image. A multi-stage Dockerfile copies the openbao-plugin-auth-ldap binary out of the image declared as the `auth-ldap` service entry into /opt/openbao/plugins. A second server config file, plugins.hcl, names that directory and registers the plugin declaratively. It sets plugin_auto_register = true explicitly: the image starts the server with a config directory, and on that path 2.7.1 does not apply the documented default, so without the line the catalog stays empty. The Dockerfile sets the file mode in a helper stage instead of COPY --chmod, which only BuildKit accepts. The mount is enabled with -plugin-version=latest, so it follows whichever plugin version the image ships. A mount created by the former builtin engine is tuned and reloaded onto the plugin, which needs `update` on sys/plugins/reload/backend in the ansible-admin policy. The LDAP tasks move into tasks/addons/auth-ldap.yml and the plugin is declared under meta/addons as a required addon bridged to `ldap`. Its Playwright spec logs in through the mount and asserts that sys/auth reports an external running plugin version. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
67 lines
1.9 KiB
YAML
67 lines
1.9 KiB
YAML
---
|
|
data:
|
|
type: volume
|
|
name: openbao_data
|
|
# nocheck: nfs-false-data-loss Reason: raft/BoltDB (mmap + fsync) corrupts over NFS; single-replica and pinned via placement: manager.
|
|
nfs: false
|
|
mounts:
|
|
- service: openbao
|
|
target: /openbao/file
|
|
|
|
logs:
|
|
type: volume
|
|
name: openbao_logs
|
|
# nocheck: nfs-false-data-loss Reason: log output only, regenerated by the server; node pinned via placement: manager.
|
|
nfs: false
|
|
mounts:
|
|
- service: openbao
|
|
target: /openbao/logs
|
|
|
|
config:
|
|
type: config
|
|
source: "{{ [lookup('container', 'web-app-openbao', 'directories.config'), 'openbao.hcl'] | path_join }}"
|
|
mode: "0444"
|
|
mounts:
|
|
- service: openbao
|
|
target: /openbao/config/openbao.hcl
|
|
|
|
config_plugins:
|
|
type: config
|
|
source: "{{ [lookup('container', 'web-app-openbao', 'directories.config'), 'plugins.hcl'] | path_join }}"
|
|
mode: "0444"
|
|
mounts:
|
|
- service: openbao
|
|
target: /openbao/config/plugins.hcl
|
|
|
|
policy_ansible_admin:
|
|
type: config
|
|
source: "{{ [lookup('container', 'web-app-openbao', 'directories.config'), 'policies', 'ansible-admin.hcl'] | path_join }}"
|
|
mode: "0444"
|
|
mounts:
|
|
- service: openbao
|
|
target: /openbao/policies/ansible-admin.hcl
|
|
|
|
policy_administrator:
|
|
type: config
|
|
source: "{{ [lookup('container', 'web-app-openbao', 'directories.config'), 'policies', 'administrator.hcl'] | path_join }}"
|
|
mode: "0444"
|
|
mounts:
|
|
- service: openbao
|
|
target: /openbao/policies/administrator.hcl
|
|
|
|
policy_operator:
|
|
type: config
|
|
source: "{{ [lookup('container', 'web-app-openbao', 'directories.config'), 'policies', 'operator.hcl'] | path_join }}"
|
|
mode: "0444"
|
|
mounts:
|
|
- service: openbao
|
|
target: /openbao/policies/operator.hcl
|
|
|
|
policy_reader:
|
|
type: config
|
|
source: "{{ [lookup('container', 'web-app-openbao', 'directories.config'), 'policies', 'reader.hcl'] | path_join }}"
|
|
mode: "0444"
|
|
mounts:
|
|
- service: openbao
|
|
target: /openbao/policies/reader.hcl
|