From 5e8cff921ca7718c44c56ebce5dcde403f8cd53c Mon Sep 17 00:00:00 2001 From: Ben Vincent Date: Thu, 6 Aug 2026 22:31:58 +1000 Subject: [PATCH] vault: keep systemd-tmpfiles from reaping openbao plugin sockets go-plugin gives each secrets plugin a control socket at /tmp/pluginNNN. The daily systemd-tmpfiles-clean deletes /tmp files older than the OS policy, which severs the socket of a long-lived plugin while its process keeps running. Every request then fails with rpc Unavailable / dial unix /tmp/pluginNNN: no such file, until a plugin reload respawns it. This hit the litellm engine (terraform-vault#112) but the risk is shared by every OpenBao plugin (gpg, rancher, gitea, ...). Ship a tmpfiles.d exclude (x /tmp/plugin*) on all vault servers so plugin sockets survive the cleaner. Takes effect on the next clean, no restart. Claude-Session: https://claude.ai/code/session_01JUoARVdmhxKQHyyyp1pxeT --- site/profiles/manifests/vault/server.pp | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/site/profiles/manifests/vault/server.pp b/site/profiles/manifests/vault/server.pp index 665b2ea..e91cc5b 100644 --- a/site/profiles/manifests/vault/server.pp +++ b/site/profiles/manifests/vault/server.pp @@ -122,6 +122,15 @@ class profiles::vault::server ( ] } + # go-plugin creates each secrets plugin's control socket as /tmp/pluginNNN; + # systemd-tmpfiles-clean reaps files aged past the /tmp policy, severing the + # socket of a long-lived plugin and orphaning the still-running process + # (every request then fails: rpc Unavailable, dial unix /tmp/pluginNNN: no + # such file). Exclude the sockets from cleaning for all plugins. + systemd::tmpfile { 'openbao-plugin-sockets.conf': + content => "x /tmp/plugin*\n", + } + # ensure the vault audit log exists file { $audit_log: ensure => 'file', -- 2.47.3