unkinben
9891311d52
## Why The Rancher token secrets engine needs its plugin binary present in the OpenBao plugin directory before terraform-vault can register/mount it. Mirrors #480 (gpg). ## Changes - Add `openbao-plugin-secrets-rancher` to `profiles::packages::include` on the vault storage role. Installs the RPM (from rpm-internal) to `/opt/openbao-plugins/vault-plugin-secrets-rancher`. ## Merge order Part 3 of 4 — merge first (binary must exist on disk before the terraform-vault plugin-import #92 registers it with a matching sha256). --------- Co-authored-by: Ben Vincent <neotheo@gmail.com> Reviewed-on: #483 Co-authored-by: Ben Vincent <ben@unkin.net> Co-committed-by: Ben Vincent <ben@unkin.net>
34 lines
1.1 KiB
YAML
34 lines
1.1 KiB
YAML
---
|
|
profiles::vault::server::members_role: roles::infra::storage::vault
|
|
profiles::vault::server::members_lookup: true
|
|
profiles::vault::server::data_dir: /data/vault
|
|
profiles::vault::server::plugin_dir: /opt/openbao-plugins
|
|
profiles::vault::server::manage_storage_dir: true
|
|
profiles::vault::server::tls_disable: false
|
|
profiles::vault::server::package_name: openbao
|
|
profiles::vault::server::package_ensure: 2.4.4
|
|
profiles::vault::server::disable_openbao: false
|
|
|
|
# additional altnames
|
|
profiles::pki::vault::alt_names:
|
|
- vault.main.unkin.net
|
|
- vault.service.consul
|
|
- vault.service.consul
|
|
- vault
|
|
|
|
# manage a simple nginx reverse proxy
|
|
profiles::nginx::simpleproxy::nginx_vhost: 'vault.service.consul'
|
|
profiles::nginx::simpleproxy::nginx_aliases:
|
|
- vault.main.unkin.net
|
|
- vault
|
|
profiles::nginx::simpleproxy::proxy_scheme: 'http'
|
|
profiles::nginx::simpleproxy::proxy_host: '127.0.0.1'
|
|
profiles::nginx::simpleproxy::proxy_port: 8200
|
|
profiles::nginx::simpleproxy::proxy_path: '/'
|
|
|
|
profiles::packages::include:
|
|
openbao-plugins: {}
|
|
openbao-plugin-secrets-litellm: {}
|
|
openbao-plugin-secrets-gpg: {}
|
|
openbao-plugin-secrets-rancher: {}
|