this repo has no description
feat(wolumonde): setup openbao for tangled spindle secrets
+250
-6
-3
hosts/wolumonde/modules/nginx.nix
-3
hosts/wolumonde/modules/nginx.nix
···
58
58
# "bsky.gaze.systems"
59
59
"dawn.gaze.systems"
60
60
"guestbook.gaze.systems"
61
-
"webhook.gaze.systems"
62
61
"dash.gaze.systems"
63
62
"knot.gaze.systems"
64
63
"spindle.gaze.systems"
65
-
"skeetdeck.gaze.systems"
66
-
"likes.gaze.systems"
67
64
"id.gaze.systems"
68
65
"vpn.gaze.systems"
69
66
];
+10
-1
hosts/wolumonde/modules/openbao.nix
hosts/wolumonde/modules/openbao.nix/default.nix
+10
-1
hosts/wolumonde/modules/openbao.nix
hosts/wolumonde/modules/openbao.nix/default.nix
···
1
-
{config, ...}: let
1
+
{lib, config, ...}: let
2
2
port = 5394;
3
3
domain = "bao.${config.services.headscale.settings.dns.base_domain}";
4
4
cfg = config.services.openbao.settings;
5
5
apiAddress = "127.0.0.1:${toString port}";
6
6
in {
7
+
imports = [./spindle-proxy];
8
+
7
9
services.openbao = {
8
10
enable = true;
9
11
settings = {
···
12
14
listener.default = {
13
15
type = "tcp";
14
16
address = apiAddress;
17
+
tls_disable = true;
15
18
};
16
19
17
20
cluster_addr = "http://127.0.0.1:8201";
···
20
23
storage.file.path = "/var/lib/openbao/data";
21
24
};
22
25
};
26
+
27
+
systemd.services.openbao.preStart = ''
28
+
mkdir -p /var/lib/openbao
29
+
rm -rf /var/lib/openbao/policies
30
+
cp -r ${./policies} /var/lib/openbao/policies
31
+
'';
23
32
24
33
services.headscale.settings.dns.extra_records = [
25
34
{
+19
hosts/wolumonde/modules/openbao.nix/policies/spindle.hcl
+19
hosts/wolumonde/modules/openbao.nix/policies/spindle.hcl
···
1
+
# Full access to spindle KV v2 data
2
+
path "spindle/data/*" {
3
+
capabilities = ["create", "read", "update", "delete"]
4
+
}
5
+
6
+
# Access to metadata for listing and management
7
+
path "spindle/metadata/*" {
8
+
capabilities = ["list", "read", "delete", "update"]
9
+
}
10
+
11
+
# Allow listing at root level
12
+
path "spindle/" {
13
+
capabilities = ["list"]
14
+
}
15
+
16
+
# Required for connection testing and health checks
17
+
path "auth/token/lookup-self" {
18
+
capabilities = ["read"]
19
+
}
+21
hosts/wolumonde/modules/openbao.nix/spindle-proxy/README.md
+21
hosts/wolumonde/modules/openbao.nix/spindle-proxy/README.md
···
1
+
see https://tangled.sh/@tangled.sh/core/blob/master/docs/spindle/openbao.md
2
+
3
+
set BAO_ADDRESS: `$env.BAO_ADDRESS = "http://bao.lan.gaze.systems"`
4
+
set BAO_TOKEN: `$env.BAO_TOKEN = "<root key>"`
5
+
6
+
create mount: `bao secrets enable -path=spindle -version=2 kv`
7
+
8
+
setup policy: `
9
+
bao policy write spindle /var/lib/openbao/policies/spindle.hcl
10
+
bao auth enable approle
11
+
bao write auth/approle/role/spindle \
12
+
token_policies="spindle" \
13
+
token_ttl=1h \
14
+
token_max_ttl=4h \
15
+
bind_secret_id=true \
16
+
secret_id_ttl=0 \
17
+
secret_id_num_uses=0
18
+
`
19
+
20
+
get role-id: `bao read -field=role_id auth/approle/role/spindle/role-id`
21
+
get secret-id: `bao write -f auth/approle/role/spindle/secret-id`
+63
hosts/wolumonde/modules/openbao.nix/spindle-proxy/config.hcl
+63
hosts/wolumonde/modules/openbao.nix/spindle-proxy/config.hcl
···
1
+
vault {
2
+
address = "%vault_address%"
3
+
4
+
# Retry configuration
5
+
retry {
6
+
num_retries = 5
7
+
}
8
+
}
9
+
10
+
# Auto-Auth using AppRole
11
+
auto_auth {
12
+
method "approle" {
13
+
mount_path = "auth/approle"
14
+
config = {
15
+
role_id_file_path = "%role_id%"
16
+
secret_id_file_path = "%secret_id%"
17
+
remove_secret_id_file_after_reading = false
18
+
}
19
+
}
20
+
21
+
# Write authenticated token to file
22
+
sink "file" {
23
+
config = {
24
+
path = "/var/lib/%name%/token"
25
+
mode = 0640
26
+
}
27
+
}
28
+
}
29
+
30
+
# API Proxy listener for Spindle
31
+
listener "tcp" {
32
+
address = "127.0.0.1:%listener_port%"
33
+
tls_disable = true
34
+
35
+
# Security headers
36
+
require_request_header = false
37
+
38
+
# Enable proxy API for management
39
+
proxy_api {
40
+
enable_quit = true
41
+
}
42
+
}
43
+
44
+
# Enable API proxy with auto-auth token
45
+
api_proxy {
46
+
use_auto_auth_token = true
47
+
}
48
+
49
+
cache {
50
+
}
51
+
52
+
# Logging configuration
53
+
log_level = "info"
54
+
log_format = "standard"
55
+
log_file = "/var/lib/%name%/proxy.log"
56
+
log_rotate_duration = "24h"
57
+
log_rotate_max_files = 30
58
+
59
+
# Process management
60
+
pid_file = "/var/lib/%name%/proxy.pid"
61
+
62
+
# Disable idle connections for reliability
63
+
disable_idle_connections = ["auto-auth", "proxying"]
+93
hosts/wolumonde/modules/openbao.nix/spindle-proxy/default.nix
+93
hosts/wolumonde/modules/openbao.nix/spindle-proxy/default.nix
···
1
+
{ config, lib, pkgs, ... }:
2
+
let
3
+
port = 8945;
4
+
secrets = config.age.secrets;
5
+
cfgFile = pkgs.writeText "openbao-proxy-spindle-config.hcl" (
6
+
lib.replaceStrings
7
+
[
8
+
"%role_id%"
9
+
"%secret_id%"
10
+
"%vault_address%"
11
+
"%listener_port%"
12
+
"%name%"
13
+
]
14
+
[
15
+
secrets.spindleOpenbaoRoleId.path
16
+
secrets.spindleOpenbaoSecretId.path
17
+
config.services.openbao.settings.api_addr
18
+
(toString port)
19
+
name
20
+
]
21
+
(lib.fileContents ./config.hcl)
22
+
);
23
+
domain = "spindle.bao.lan.gaze.systems";
24
+
name = "openbao-proxy-spindle";
25
+
in
26
+
{
27
+
age.secrets.spindleOpenbaoRoleId = {
28
+
file = ../../../../../secrets/spindleOpenbaoRoleId.age;
29
+
mode = "600";
30
+
owner = name;
31
+
group = name;
32
+
};
33
+
age.secrets.spindleOpenbaoSecretId = {
34
+
file = ../../../../../secrets/spindleOpenbaoSecretId.age;
35
+
mode = "600";
36
+
owner = name;
37
+
group = name;
38
+
};
39
+
40
+
users.users.${name} = {
41
+
isSystemUser = true;
42
+
group = name;
43
+
};
44
+
users.groups.${name} = {
45
+
members = [name];
46
+
};
47
+
48
+
systemd.services.${name} = {
49
+
description = "OpenBao Proxy with Auto-Auth for tangled spindle";
50
+
after = [ "openbao.service" ];
51
+
before = [ "spindle.service" ];
52
+
requires = [ "openbao.service" ];
53
+
wantedBy = [ "multi-user.target" ];
54
+
serviceConfig = {
55
+
ExecStart = "${pkgs.openbao}/bin/bao proxy -config=${cfgFile}";
56
+
Restart = "on-failure";
57
+
RestartSec = "5";
58
+
LimitNOFILE = "65536";
59
+
User = name;
60
+
Group = name;
61
+
RuntimeDirectory=name;
62
+
RuntimeDirectoryMode=0700;
63
+
StateDirectory=name;
64
+
StateDirectoryMode=0700;
65
+
ProcSubset="pid";
66
+
ProtectClock=true;
67
+
ProtectControlGroups=true;
68
+
ProtectHome=true;
69
+
ProtectHostname=true;
70
+
ProtectKernelLogs=true;
71
+
ProtectKernelModules=true;
72
+
ProtectKernelTunables=true;
73
+
ProtectProc="invisible";
74
+
RestrictNamespaces=true;
75
+
RestrictRealtime=true;
76
+
RestrictAddressFamilies=["AF_INET" "AF_INET6" "AF_UNIX"];
77
+
SystemCallArchitectures="native";
78
+
SystemCallFilter=["@system-service" "@resources" "~@privileged"];
79
+
};
80
+
};
81
+
82
+
services.headscale.settings.dns.extra_records = [
83
+
{
84
+
name = domain;
85
+
type = "A";
86
+
value = "100.64.0.2";
87
+
}
88
+
];
89
+
services.nginx.virtualHosts.${domain} = {
90
+
quic = true;
91
+
locations."/".proxyPass = "http://127.0.0.1:${toString port}";
92
+
};
93
+
}
+2
-2
hosts/wolumonde/modules/tangled.nix
+2
-2
hosts/wolumonde/modules/tangled.nix
···
49
49
owner = "did:plc:dfl62fgb7wtjj3fcbb72naae";
50
50
secrets = {
51
51
provider = "openbao";
52
-
openbao.proxyAddr = "http://bao.lan.gaze.systems";
52
+
openbao.proxyAddr = "http://spindle.bao.lan.gaze.systems";
53
53
};
54
54
};
55
55
};
···
60
60
users.groups.spindle = { };
61
61
users.groups.podman.members = [ "spindle" ];
62
62
systemd.services.spindle = {
63
-
after = lib.mkForce [ "network.target" ];
63
+
after = lib.mkForce [ "network.target" "openbao-proxy-spindle.service" ];
64
64
serviceConfig = {
65
65
User = "spindle";
66
66
Group = "spindle";
+8
secrets/secrets.nix
+8
secrets/secrets.nix
+17
secrets/spindleOpenbaoRoleId.age
+17
secrets/spindleOpenbaoRoleId.age
···
1
+
age-encryption.org/v1
2
+
-> ssh-rsa Abmvag
3
+
i1WEFfFEf7rvpH8pfM4+Z7mBSJwzAa/xNP5YMp0aVk9AMpFoT/39mwzr0LMtnruk
4
+
u8Dz3ILegSyc69L9Ge1rNX6L5mN0qUyjsN1h/cMCh9Cgw4DxYkRB9NYI3xNUQFau
5
+
xHVbgJ8DBDwZ3XnM0JYf9c23Kk1oft+PV07JKtyBN6r8JGCpu7N5Ccb/oj4epnS0
6
+
0DgoEDLT9DgiZXVo+Q6w++gfSq58ClYaguoHaDCTBdRKHans9BWIqJ7pAOu9hXcl
7
+
vyuw/jz0bwKKh474xiCHArw4xN+ji7aFTRG3FkeK52giWoK95+P4z5ieaHJKz2jk
8
+
I4HiGjgpfDGJzsgz5yEJFhntlnOWVHChvyZ1QSEKe2OIGAQmfGSbDRBYPS2wrfeL
9
+
v8JueFHCG4ABh53+guzmjTMZTRjh8O5d2YEcrrWhGgwssHxUTzNE4KUCVkNV4/OS
10
+
6+hvmU1NC8rYBNMRiZtYiu6osmtWndYYFCsJpURfyFoDzCWmvjl6pxNFTtTTukMm
11
+
WBgKxC2K4EwQ27k6IExm2epDH5kwdJrPGe8yZIl3zK9Y1Sa+Q3LYp8D5QWUv2uts
12
+
lQXTVvJVrg9wn1AfxCnGBApCPIvEiw8PwU/adfa+UMKN/kGMvE6iL0+J2aGTxO4l
13
+
zmyLUErh9f8iBIF/90DIqf9FrjBWcbtv3zphmgHZkII
14
+
-> ssh-ed25519 KjIL7g GZl/qIbkVajzJn0ZsI0ImzIyGdjm1tMFbEh4LnOALAA
15
+
WXYCRfsfYU+nI67+4d6PX/iER2aA7Flt6xWPlvYELDg
16
+
--- Y8pLVkJQfP5piXtWJ3AegPsLLj3NDWXpmt3aoiwicgo
17
+
E�RR�y��������@� ���X���t�$ǻ��s���Ǟ���~��|�r�F�~�n��NG
+17
secrets/spindleOpenbaoSecretId.age
+17
secrets/spindleOpenbaoSecretId.age
···
1
+
age-encryption.org/v1
2
+
-> ssh-rsa Abmvag
3
+
G3DtXBNVhNcRiXlpQ7iJ8kZrsu59WF62pnLheEGKj2JGg6m+LLOqLChQg1YOSjB1
4
+
zIy3QwpfXB4Rn081lXEXKvs6Jr1FbAkhggeLLtflPEAouxPiJ1HkxtyCNv02L+Pj
5
+
uBvi32fMnTw3Kep6LTNBqkAhsvFNf02zsNxm+KfFpwn+kWvUtGdsHeAsWIXO/4lL
6
+
FjbPI860FvbfrAp0r7Hv79MRLYTUhki7gX+VZooEngobCImTiq9NR++MpdsMmovC
7
+
hst6CESEuTdqhw2SrTteGU10E+5q1jd1z0T+ttHe0GqKmQwuQB4S1KtSx74xiQhV
8
+
gg8ZyVAVdSt49s9YLRMdJjFWHXNPC3GKQzlXWZ4xLrpeBc3YrQhp3+7iRhRB92gX
9
+
GhWdw/UN9fKPbILi2W+3bSEByGzJ2iBo0BMxK0I7541ZgpQHOOvySLHzElnpRdwD
10
+
I3+GuDif1cHusLBVruwUubfr11UwzOLkUgzP504Sf55liMSjnq5DxzkaUERzTg/T
11
+
SNmC9misXkxUpwWSYKjSEe5p3x8CsJwmVkrXh+N9GFiYD+Al/9aWPrmw+Kl4CMe6
12
+
MJlxCpfVKTdx3ePA7d7POx1RQuBf78nTg5XCyBf2BB2lycKkg05hX+1VzTCYMChZ
13
+
zLh1RiSWtRxgIbljwWanPW0AmZaDkRTxdilbFg2sa7U
14
+
-> ssh-ed25519 KjIL7g C+NvzMVX+2NdIXoYGPv1yeGRaHnSEQQuG7MS3e5SKlE
15
+
L5TFRde0T/sn8teeFuBy3c8fydmiI07NT+pFnIIyYwE
16
+
--- fcPjYFQG6lbT2cGzt/oZhO5PahAoiN4yUT12xa4Kc8s
17
+
�ZZ�/h��������p�] �AR!�O��`�2 ��K<���Eo��R����VN
�����G�p��0u