1 changed files with 9 additions and 0 deletions
@@ -122,6 +122,15 @@ class profiles::vault::server (
      ]
    }

+    # go-plugin creates each secrets plugin's control socket as /tmp/pluginNNN;
+    # systemd-tmpfiles-clean reaps files aged past the /tmp policy, severing the
+    # socket of a long-lived plugin and orphaning the still-running process
+    # (every request then fails: rpc Unavailable, dial unix /tmp/pluginNNN: no
+    # such file). Exclude the sockets from cleaning for all plugins.
+    systemd::tmpfile { 'openbao-plugin-sockets.conf':
+      content => "x /tmp/plugin*\n",
+    }
+
    # ensure the vault audit log exists
    file { $audit_log:
      ensure => 'file',