Build an OpenBao RPM alongside the Vault one #3

2026-07-06T23:14:59+10:00

unkinben commented

2026-07-06 23:14:59 +10:00

The plugin runs under both Vault and OpenBao, but nfpm only produced a single RPM that installs into /opt/vault-plugins. OpenBao hosts expect their plugins under /opt/openbao-plugins, so a second package is needed.

Changes

Parameterize nfpm.yaml with PACKAGE_NAME, PACKAGE_PLUGIN_DIR, and PACKAGE_PREINSTALL so one config renders per target server
Replace the static preinstall.sh with preinstall.sh.tmpl that mkdir -p's the flavour's plugin directory
Build two RPMs in build-rpm.sh via a build_flavor helper: vault-plugin-secrets-litellm → /opt/vault-plugins and openbao-plugin-secrets-litellm → /opt/openbao-plugins

Both packages wrap the same binary, provides/replaces only their own name (so they coexist on one host), and are picked up automatically by the existing dist/*.rpm upload step. Verified locally: both RPMs build and install the binary to the correct directory with a matching preinstall.

The plugin runs under both Vault and OpenBao, but nfpm only produced a single RPM that installs into `/opt/vault-plugins`. OpenBao hosts expect their plugins under `/opt/openbao-plugins`, so a second package is needed. ## Changes - Parameterize `nfpm.yaml` with `PACKAGE_NAME`, `PACKAGE_PLUGIN_DIR`, and `PACKAGE_PREINSTALL` so one config renders per target server - Replace the static `preinstall.sh` with `preinstall.sh.tmpl` that `mkdir -p`'s the flavour's plugin directory - Build two RPMs in `build-rpm.sh` via a `build_flavor` helper: `vault-plugin-secrets-litellm` → `/opt/vault-plugins` and `openbao-plugin-secrets-litellm` → `/opt/openbao-plugins` Both packages wrap the same binary, `provides`/`replaces` only their own name (so they coexist on one host), and are picked up automatically by the existing `dist/*.rpm` upload step. Verified locally: both RPMs build and install the binary to the correct directory with a matching preinstall.

unkinben added 1 commit 2026-07-06 23:14:59 +10:00

Build an OpenBao RPM alongside the Vault one

ci/woodpecker/pr/pre-commit Pipeline was successful

Details

ci/woodpecker/pr/test Pipeline was successful

Details

ci/woodpecker/pr/build Pipeline was successful

Details

ac38203b8e

The plugin runs under both Vault and OpenBao, but nfpm only produced a
single RPM that installs into /opt/vault-plugins. OpenBao hosts expect
their plugins under /opt/openbao-plugins, so a second package is needed.

- Parameterize nfpm.yaml with PACKAGE_NAME, PACKAGE_PLUGIN_DIR, and
  PACKAGE_PREINSTALL so one config renders per target server
- Replace the static preinstall.sh with preinstall.sh.tmpl that
  mkdir -p's the flavour's plugin directory
- Build two RPMs in build-rpm.sh via a build_flavor helper:
  vault-plugin-secrets-litellm -> /opt/vault-plugins and
  openbao-plugin-secrets-litellm -> /opt/openbao-plugins

benvin merged commit 3edff726f2 into main

2026-07-06 23:21:49 +10:00

benvin deleted branch benvin/openbao-rpm

2026-07-06 23:21:50 +10:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: unkin/vault-plugin-secrets-litellm#3