vault: revert to confidential client, Web UI only (no CLI)

2026-02-09 19:29:00 +01:00
parent 35a5a91fcf
commit 9dec754eed
4 changed files with 18 additions and 7 deletions
--- a/terraform/vault/secrets.tf
+++ b/terraform/vault/secrets.tf
@@ -115,6 +115,11 @@ locals {
      password_length = 64
    }

+    # OpenBao OAuth2 client secret (for Kanidm OIDC)
+    "services/openbao/oauth2-client-secret" = {
+      auto_generate   = true
+      password_length = 64
+    }

    # NKey for nixos-exporter NATS cache sharing
    "shared/nixos-exporter/nkey" = {