From c8cc60fdb8479eae0dbc8d2858a4b50b56cbda9e Mon Sep 17 00:00:00 2001
From: Ben Vincent <ben@unkin.net>
Date: Thu, 16 Jul 2026 22:43:23 +1000
Subject: [PATCH] chore: install openbao-plugin-secrets-gpg on vault nodes

Deploy the GPG/OpenPGP secrets engine to the OpenBao (vault-role) cluster by
installing its plugin RPM into /opt/openbao-plugins, mirroring the existing
openbao-plugin-secrets-litellm deployment. The RPM ships from artifactapi
rpm-internal (built on the vault-plugin-secrets-gpg v0.1.0 tag).

Registering/enabling the backend is a separate terraform-vault change.
---
 hieradata/roles/infra/storage/vault.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hieradata/roles/infra/storage/vault.yaml b/hieradata/roles/infra/storage/vault.yaml
index 9af5305..4f716f7 100644
--- a/hieradata/roles/infra/storage/vault.yaml
+++ b/hieradata/roles/infra/storage/vault.yaml
@@ -29,3 +29,4 @@ profiles::nginx::simpleproxy::proxy_path: '/'
 profiles::packages::include:
   openbao-plugins: {}
   openbao-plugin-secrets-litellm: {}
+  openbao-plugin-secrets-gpg: {}