torjus/nixos-servers
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects 1 Releases Wiki Activity

fixup! vault: implement bootstrap integration

Browse Source
This commit is contained in:
Torjus Håkestad
2026-02-03 00:26:43 +01:00
parent 6638f2e818
commit 092f02b2ba
12 changed files with 25 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
TODO.md
View File

@@ -185,7 +185,7 @@ create-host \
**Current Architecture:** **Current Architecture:**
``` ```
vault.home.2rjus.net (10.69.13.19) vault01.home.2rjus.net (10.69.13.19)
├─ KV Secrets Engine (ready to replace sops-nix) ├─ KV Secrets Engine (ready to replace sops-nix)
│ ├─ secret/hosts/{hostname}/* │ ├─ secret/hosts/{hostname}/*
│ ├─ secret/services/{service}/* │ ├─ secret/services/{service}/*
@@ -243,7 +243,7 @@ vault.home.2rjus.net (10.69.13.19)
- [x] File storage backend - [x] File storage backend
- [x] Self-signed TLS certificates via LoadCredential - [x] Self-signed TLS certificates via LoadCredential
- [x] Deploy to infrastructure - [x] Deploy to infrastructure
- [x] DNS entry added for vault.home.2rjus.net - [x] DNS entry added for vault01.home.2rjus.net
- [x] VM deployed via terraform - [x] VM deployed via terraform
- [x] Verified OpenBao running and auto-unsealing - [x] Verified OpenBao running and auto-unsealing
@@ -353,7 +353,7 @@ vault.home.2rjus.net (10.69.13.19)
- [x] Enabled ACME on intermediate CA - [x] Enabled ACME on intermediate CA
- [x] Created PKI role for `*.home.2rjus.net` - [x] Created PKI role for `*.home.2rjus.net`
- [x] Set certificate TTLs (30 day max) and allowed domains - [x] Set certificate TTLs (30 day max) and allowed domains
- [x] ACME directory: `https://vault.home.2rjus.net:8200/v1/pki_int/acme/directory` - [x] ACME directory: `https://vault01.home.2rjus.net:8200/v1/pki_int/acme/directory`
- [ ] Download and distribute root CA certificate - [ ] Download and distribute root CA certificate
- [ ] Export root CA: `bao read -field=certificate pki/cert/ca > homelab-root-ca.crt` - [ ] Export root CA: `bao read -field=certificate pki/cert/ca > homelab-root-ca.crt`
- [ ] Add to NixOS trust store on all hosts via `security.pki.certificateFiles` - [ ] Add to NixOS trust store on all hosts via `security.pki.certificateFiles`
@@ -368,7 +368,7 @@ vault.home.2rjus.net (10.69.13.19)
- [ ] Update service configuration - [ ] Update service configuration
- [ ] Migrate hosts from step-ca to OpenBao - [ ] Migrate hosts from step-ca to OpenBao
- [ ] Update `system/acme.nix` to use OpenBao ACME endpoint - [ ] Update `system/acme.nix` to use OpenBao ACME endpoint
- [ ] Change server to `https://vault.home.2rjus.net:8200/v1/pki_int/acme/directory` - [ ] Change server to `https://vault01.home.2rjus.net:8200/v1/pki_int/acme/directory`
- [ ] Test on one host (non-critical service) - [ ] Test on one host (non-critical service)
- [ ] Roll out to all hosts via auto-upgrade - [ ] Roll out to all hosts via auto-upgrade
- [ ] Configure SSH CA in OpenBao (optional, future work) - [ ] Configure SSH CA in OpenBao (optional, future work)

6
docs/vault-bootstrap-implementation.md
View File

@@ -37,7 +37,7 @@ Phase 4d implements automatic Vault/OpenBao integration for new NixOS hosts, ena
│ Cloud-init (VM Provisioning) │ │ Cloud-init (VM Provisioning) │
│ │ │ │
│ /etc/environment: │ │ /etc/environment: │
│ VAULT_ADDR=https://vault.home.2rjus.net:8200 │ │ VAULT_ADDR=https://vault01.home.2rjus.net:8200 │
│ VAULT_WRAPPED_TOKEN=hvs.CAES... │ │ VAULT_WRAPPED_TOKEN=hvs.CAES... │
│ VAULT_SKIP_VERIFY=1 │ │ VAULT_SKIP_VERIFY=1 │
└─────────────────────────────────────────────────────────────┘ └─────────────────────────────────────────────────────────────┘
@@ -117,7 +117,7 @@ vault-fetch hosts/monitoring01/grafana /run/secrets/grafana
``` ```
**Environment Variables**: **Environment Variables**:
- `VAULT_ADDR`: Vault server (default: https://vault.home.2rjus.net:8200) - `VAULT_ADDR`: Vault server (default: https://vault01.home.2rjus.net:8200)
- `VAULT_SKIP_VERIFY`: Skip TLS verification (default: 1) - `VAULT_SKIP_VERIFY`: Skip TLS verification (default: 1)
**Error Handling**: **Error Handling**:
@@ -237,7 +237,7 @@ fi
write_files: write_files:
- path: /etc/environment - path: /etc/environment
content: | content: |
VAULT_ADDR=https://vault.home.2rjus.net:8200 VAULT_ADDR=https://vault01.home.2rjus.net:8200
VAULT_WRAPPED_TOKEN=${vault_wrapped_token} VAULT_WRAPPED_TOKEN=${vault_wrapped_token}
VAULT_SKIP_VERIFY=1 VAULT_SKIP_VERIFY=1
``` ```

6
docs/vault-bootstrap-testing.md
View File

@@ -6,7 +6,7 @@ This guide walks through testing the complete Vault bootstrap workflow implement
Before testing, ensure: Before testing, ensure:
1. **Vault server is running**: vault01 (vault.home.2rjus.net:8200) is accessible 1. **Vault server is running**: vault01 (vault01.home.2rjus.net:8200) is accessible
2. **Vault access**: You have a Vault token with admin permissions (set `BAO_TOKEN` env var) 2. **Vault access**: You have a Vault token with admin permissions (set `BAO_TOKEN` env var)
3. **Terraform installed**: OpenTofu is available in your PATH 3. **Terraform installed**: OpenTofu is available in your PATH
4. **Git repository clean**: All Phase 4d changes are committed to a branch 4. **Git repository clean**: All Phase 4d changes are committed to a branch
@@ -172,7 +172,7 @@ tofu apply
**Verify the secret exists:** **Verify the secret exists:**
```bash ```bash
export VAULT_ADDR=https://vault.home.2rjus.net:8200 export VAULT_ADDR=https://vault01.home.2rjus.net:8200
export VAULT_SKIP_VERIFY=1 export VAULT_SKIP_VERIFY=1
vault kv get secret/hosts/vaulttest01/test-service vault kv get secret/hosts/vaulttest01/test-service
@@ -227,7 +227,7 @@ systemctl status vault-secret-test-service.service
journalctl -u vault-secret-test-service.service journalctl -u vault-secret-test-service.service
# Should show successful secret fetch: # Should show successful secret fetch:
# [vault-fetch] Authenticating to Vault at https://vault.home.2rjus.net:8200 # [vault-fetch] Authenticating to Vault at https://vault01.home.2rjus.net:8200
# [vault-fetch] Successfully authenticated to Vault # [vault-fetch] Successfully authenticated to Vault
# [vault-fetch] Fetching secret from path: hosts/vaulttest01/test-service # [vault-fetch] Fetching secret from path: hosts/vaulttest01/test-service
# [vault-fetch] Writing secrets to /run/secrets/test-service # [vault-fetch] Writing secrets to /run/secrets/test-service

2
hosts/template2/bootstrap.nix
View File

@@ -27,7 +27,7 @@ let
if [ -n "''${VAULT_WRAPPED_TOKEN:-}" ]; then if [ -n "''${VAULT_WRAPPED_TOKEN:-}" ]; then
echo "Unwrapping Vault token to get AppRole credentials..." echo "Unwrapping Vault token to get AppRole credentials..."
VAULT_ADDR="''${VAULT_ADDR:-https://vault.home.2rjus.net:8200}" VAULT_ADDR="''${VAULT_ADDR:-https://vault01.home.2rjus.net:8200}"
# Unwrap the token to get role_id and secret_id # Unwrap the token to get role_id and secret_id
UNWRAP_RESPONSE=$(curl -sk -X POST \ UNWRAP_RESPONSE=$(curl -sk -X POST \

2
scripts/create-host/vault_helper.py
View File

@@ -25,7 +25,7 @@ def get_vault_client(vault_addr: Optional[str] = None, vault_token: Optional[str
""" """
# Get Vault address # Get Vault address
if vault_addr is None: if vault_addr is None:
vault_addr = os.getenv("BAO_ADDR", "https://vault.home.2rjus.net:8200") vault_addr = os.getenv("BAO_ADDR", "https://vault01.home.2rjus.net:8200")
# Get Vault token # Get Vault token
if vault_token is None: if vault_token is None:

2
scripts/vault-fetch/README.md
View File

@@ -45,7 +45,7 @@ If Vault is unreachable or authentication fails:
## Environment Variables ## Environment Variables
- `VAULT_ADDR`: Vault server address (default: `https://vault.home.2rjus.net:8200`) - `VAULT_ADDR`: Vault server address (default: `https://vault01.home.2rjus.net:8200`)
- `VAULT_SKIP_VERIFY`: Skip TLS verification (default: `1`) - `VAULT_SKIP_VERIFY`: Skip TLS verification (default: `1`)
## Integration with NixOS ## Integration with NixOS

2
scripts/vault-fetch/vault-fetch.sh
View File

@@ -26,7 +26,7 @@ OUTPUT_DIR="$2"
CACHE_DIR="${3:-/var/lib/vault/cache/$(basename "$OUTPUT_DIR")}" CACHE_DIR="${3:-/var/lib/vault/cache/$(basename "$OUTPUT_DIR")}"
# Vault configuration # Vault configuration
VAULT_ADDR="${VAULT_ADDR:-https://vault.home.2rjus.net:8200}" VAULT_ADDR="${VAULT_ADDR:-https://vault01.home.2rjus.net:8200}"
VAULT_SKIP_VERIFY="${VAULT_SKIP_VERIFY:-1}" VAULT_SKIP_VERIFY="${VAULT_SKIP_VERIFY:-1}"
APPROLE_DIR="/var/lib/vault/approle" APPROLE_DIR="/var/lib/vault/approle"

2
system/vault-secrets.nix
View File

@@ -124,7 +124,7 @@ in
vaultAddress = mkOption { vaultAddress = mkOption {
type = types.str; type = types.str;
default = "https://vault.home.2rjus.net:8200"; default = "https://vault01.home.2rjus.net:8200";
description = "Vault server address"; description = "Vault server address";
}; };

12
terraform/vault/README.md
View File

@@ -19,7 +19,7 @@ Manages the following OpenBao resources:
2. **Edit `terraform.tfvars` with your OpenBao credentials:** 2. **Edit `terraform.tfvars` with your OpenBao credentials:**
```hcl ```hcl
vault_address = "https://vault.home.2rjus.net:8200" vault_address = "https://vault01.home.2rjus.net:8200"
vault_token = "hvs.your-root-token-here" vault_token = "hvs.your-root-token-here"
vault_skip_tls_verify = true vault_skip_tls_verify = true
``` ```
@@ -120,7 +120,7 @@ bao write pki_int/config/acme enabled=true
ACME directory endpoint: ACME directory endpoint:
``` ```
https://vault.home.2rjus.net:8200/v1/pki_int/acme/directory https://vault01.home.2rjus.net:8200/v1/pki_int/acme/directory
``` ```
Use with ACME clients (lego, certbot, cert-manager, etc.): Use with ACME clients (lego, certbot, cert-manager, etc.):
@@ -128,7 +128,7 @@ Use with ACME clients (lego, certbot, cert-manager, etc.):
# Example with lego # Example with lego
lego --email admin@home.2rjus.net \ lego --email admin@home.2rjus.net \
--dns manual \ --dns manual \
--server https://vault.home.2rjus.net:8200/v1/pki_int/acme/directory \ --server https://vault01.home.2rjus.net:8200/v1/pki_int/acme/directory \
--accept-tos \ --accept-tos \
run -d test.home.2rjus.net run -d test.home.2rjus.net
``` ```
@@ -239,18 +239,18 @@ After deploying this configuration, perform these one-time setup tasks:
### 1. Enable ACME ### 1. Enable ACME
```bash ```bash
export BAO_ADDR='https://vault.home.2rjus.net:8200' export BAO_ADDR='https://vault01.home.2rjus.net:8200'
export BAO_TOKEN='your-root-token' export BAO_TOKEN='your-root-token'
export BAO_SKIP_VERIFY=1 export BAO_SKIP_VERIFY=1
# Configure cluster path (required for ACME) # Configure cluster path (required for ACME)
bao write pki_int/config/cluster path=https://vault.home.2rjus.net:8200/v1/pki_int bao write pki_int/config/cluster path=https://vault01.home.2rjus.net:8200/v1/pki_int
# Enable ACME on intermediate CA # Enable ACME on intermediate CA
bao write pki_int/config/acme enabled=true bao write pki_int/config/acme enabled=true
# Verify ACME is enabled # Verify ACME is enabled
curl -k https://vault.home.2rjus.net:8200/v1/pki_int/acme/directory curl -k https://vault01.home.2rjus.net:8200/v1/pki_int/acme/directory
``` ```
### 2. Download Root CA Certificate ### 2. Download Root CA Certificate

4
terraform/vault/pki.tf
View File

@@ -16,7 +16,7 @@
# #
# 1. ACME (Automated Certificate Management Environment) # 1. ACME (Automated Certificate Management Environment)
# - Services fetch certificates automatically using ACME protocol # - Services fetch certificates automatically using ACME protocol
# - ACME directory: https://vault.home.2rjus.net:8200/v1/pki_int/acme/directory # - ACME directory: https://vault01.home.2rjus.net:8200/v1/pki_int/acme/directory
# - Enable ACME: bao write pki_int/config/acme enabled=true # - Enable ACME: bao write pki_int/config/acme enabled=true
# - Compatible with cert-manager, lego, certbot, etc. # - Compatible with cert-manager, lego, certbot, etc.
# #
@@ -149,7 +149,7 @@ locals {
static_certificates = { static_certificates = {
# Example: Issue a certificate for a specific service # Example: Issue a certificate for a specific service
# "vault" = { # "vault" = {
# common_name = "vault.home.2rjus.net" # common_name = "vault01.home.2rjus.net"
# alt_names = ["vault01.home.2rjus.net"] # alt_names = ["vault01.home.2rjus.net"]
# ip_sans = ["10.69.13.19"] # ip_sans = ["10.69.13.19"]
# ttl = "8760h" # 1 year # ttl = "8760h" # 1 year

2
terraform/vault/terraform.tfvars.example
View File

@@ -1,6 +1,6 @@
# Copy this file to terraform.tfvars and fill in your values # Copy this file to terraform.tfvars and fill in your values
# terraform.tfvars is gitignored to keep credentials safe # terraform.tfvars is gitignored to keep credentials safe
vault_address = "https://vault.home.2rjus.net:8200" vault_address = "https://vault01.home.2rjus.net:8200"
vault_token = "hvs.XXXXXXXXXXXXXXXXXXXX" vault_token = "hvs.XXXXXXXXXXXXXXXXXXXX"
vault_skip_tls_verify = true vault_skip_tls_verify = true

2
terraform/vault/variables.tf
View File

@@ -1,7 +1,7 @@
variable "vault_address" { variable "vault_address" {
description = "OpenBao server address" description = "OpenBao server address"
type = string type = string
default = "https://vault.home.2rjus.net:8200" default = "https://vault01.home.2rjus.net:8200"
} }
variable "vault_token" { variable "vault_token" {