mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-08 03:38:23 +00:00
evangelostsak
4046dd2a0a
The static seal supports n-1 to n rotation. Emitting the previous pair only while the two keys differ lets the node unseal with the old key and rewrap to the new one; a first deploy still renders a single-key stanza.
38 lines
775 B
Django/Jinja
38 lines
775 B
Django/Jinja
ui = true
|
|
|
|
log_level = "{{ OPENBAO_LOG_LEVEL }}"
|
|
|
|
disable_mlock = true
|
|
|
|
storage "raft" {
|
|
path = "{{ OPENBAO_DATA_DOCKER }}"
|
|
node_id = "{{ OPENBAO_NAME }}-1"
|
|
}
|
|
|
|
listener "tcp" {
|
|
address = "0.0.0.0:{{ container_port }}"
|
|
tls_disable = true
|
|
|
|
telemetry {
|
|
unauthenticated_metrics_access = true
|
|
}
|
|
}
|
|
|
|
seal "static" {
|
|
current_key_id = "{{ OPENBAO_SEAL_KEY_ID }}"
|
|
current_key = "env://OPENBAO_SEAL_KEY"
|
|
{% if OPENBAO_SEAL_ROTATING | bool %}
|
|
previous_key_id = "{{ OPENBAO_SEAL_KEY_PREVIOUS_ID }}"
|
|
previous_key = "env://OPENBAO_SEAL_KEY_PREVIOUS"
|
|
{% endif %}
|
|
}
|
|
|
|
telemetry {
|
|
prometheus_retention_time = "24h"
|
|
disable_hostname = true
|
|
}
|
|
|
|
api_addr = "{{ OPENBAO_BASE_URL }}"
|
|
|
|
cluster_addr = "http://127.0.0.1:{{ container_port | int + 1 }}"
|