From 26c5235d0077ad3078cd36f79b130af190b747cb Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Thu, 6 Aug 2026 22:41:46 +1000 Subject: [PATCH] vault: move openbao plugin sockets off /tmp onto a /run RuntimeDirectory go-plugin creates each secrets plugin's control socket under the process TMPDIR (/tmp/pluginNNN by default). The daily systemd-tmpfiles-clean deletes aged /tmp files, severing the socket of a long-lived plugin while its process keeps running, so every request fails with rpc Unavailable / dial unix /tmp/pluginNNN: no such file until a reload respawns it. This took out the litellm engine (terraform-vault#112); the risk is shared by every OpenBao plugin (gpg, rancher, gitea, ...). Add a vault.service drop-in setting TMPDIR to a per-start RuntimeDirectory on /run (tmpfs, no age-based cleanup), so plugin sockets can never be reaped. The drop-in notifies a vault restart so the new TMPDIR takes effect and plugins respawn with sockets under /run. Claude-Session: https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT --- site/profiles/manifests/vault/server.pp | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/site/profiles/manifests/vault/server.pp b/site/profiles/manifests/vault/server.pp index 665b2ea..3a7ecff 100644 --- a/site/profiles/manifests/vault/server.pp +++ b/site/profiles/manifests/vault/server.pp @@ -130,6 +130,20 @@ class profiles::vault::server ( mode => '0600', } + # go-plugin creates each secrets plugin's control socket under TMPDIR + # (/tmp/pluginNNN by default); systemd-tmpfiles-clean reaps aged /tmp files + # and severs the socket of a long-lived plugin, orphaning the process. Point + # TMPDIR at a per-start RuntimeDirectory on /run (tmpfs, no age cleanup). + systemd::manage_dropin { 'plugin-tmpdir.conf': + unit => 'vault.service', + service_entry => { + 'RuntimeDirectory' => 'vault-plugins', + 'RuntimeDirectoryMode' => '0700', + 'Environment' => 'TMPDIR=/run/vault-plugins', + }, + notify => Service['vault'], + } + service { 'vault': ensure => true, enable => true,