The plugin runs under both Vault and OpenBao, but nfpm only produced a
single RPM that installs into /opt/vault-plugins. OpenBao hosts expect
their plugins under /opt/openbao-plugins, so a second package is needed.
- Parameterize nfpm.yaml with PACKAGE_NAME, PACKAGE_PLUGIN_DIR, and
PACKAGE_PREINSTALL so one config renders per target server
- Replace the static preinstall.sh with preinstall.sh.tmpl that
mkdir -p's the flavour's plugin directory
- Build two RPMs in build-rpm.sh via a build_flavor helper:
vault-plugin-secrets-litellm -> /opt/vault-plugins and
openbao-plugin-secrets-litellm -> /opt/openbao-plugins
Publish the plugin as an installable RPM so hosts can drop it into the Vault/
OpenBao plugin directory. On a tag, build the binary, package it with nfpm
(mirroring the rpmbuilder approach), and upload the RPM to artifactapi's local
rpm-internal repository.
- Add packaging/nfpm.yaml installing the binary to /opt/vault-plugins/ plus a
preinstall script that creates the directory
- Add scripts/build-rpm.sh and make rpm / rpm-package targets
- Add .woodpecker/release.yml (event: tag): build -> nfpm package -> PUT to
artifactapi remotes/rpm-internal/files/
Populate the repo with the Vault/OpenBao dynamic secrets engine that mints
LiteLLM virtual keys scoped by model, spending limit, and lease TTL.
- Secrets backend: config, roles, creds paths and a revocable litellm_key type
- LiteLLM API client (generate/update/delete/info) with master-key auth
- Unit tests (mock LiteLLM) and a docker-compose e2e against both Vault and
OpenBao proving the same binary works on each
- Makefile, woodpecker CI (build/test/pre-commit), pre-commit config
unkinben