kevinveenbirkenbachandClaude Opus 5.5 86dee1edc5 feat(web-app-openbao): record every request through a declared stdout audit device ...

OpenBao keeps no record of who read which secret without an audit device,
and 2.7 refuses to enable one over the API, so the server config declares a
file device writing to stdout, which cannot block and lands in the container
log with secret values only as salted HMACs. Every deploy fails unless the
device is active, a probe secret read through the AppRole session shows up
in the log with path, operation, display_name and time, and the probe value
does not appear in plaintext. openbao becomes a regular shared provider so
consumers such as the landing page role can declare services.openbao.
Requirement 047; taken over from the feature/openbao-audit worktree.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

2026-10-29 00:07:17 +01:00

..

cli

feat(roles): pull custom roles from inventory-declared sources

2026-10-29 00:02:58 +01:00

group_vars

fix(group_vars): evaluate the CAPTCHA flags only for a configured provider

2026-10-25 20:58:06 +01:00

library

perf(sys-svc-compose): prepare the compose instance in one module call

2026-10-25 21:22:32 +01:00

plugins

perf(packages): install every role's packages per host in one run at deploy start

2026-10-28 22:54:36 +01:00

roles

feat(web-app-openbao): record every request through a declared stdout audit device

2026-10-29 00:07:17 +01:00

scripts

…

tests

feat(roles): pull custom roles from inventory-declared sources

2026-10-29 00:02:58 +01:00

utils

feat(roles): pull custom roles from inventory-declared sources

2026-10-29 00:02:58 +01:00

__init__.py

…