Torjus Håkestad
4fa884b60b
Some checks failed
Run nix flake check / flake-check (push) Has been cancelled
73 lines
2.0 KiB
Nix
73 lines
2.0 KiB
Nix
{ pkgs, ... }:
|
|
let
|
|
unsealScript = pkgs.writeShellApplication {
|
|
name = "openbao-unseal";
|
|
runtimeInputs = with pkgs; [ openbao coreutils ];
|
|
text = ''
|
|
# Set environment to use Unix socket
|
|
export BAO_ADDR='unix:///run/openbao/openbao.sock'
|
|
|
|
# Wait for OpenBao to be ready
|
|
echo "Waiting for OpenBao to be ready..."
|
|
for i in {1..30}; do
|
|
if bao status >/dev/null 2>&1; then
|
|
echo "OpenBao is ready"
|
|
break
|
|
fi
|
|
sleep 1
|
|
done
|
|
|
|
# Check if already unsealed
|
|
if bao status 2>&1 | grep -q "Sealed.*false"; then
|
|
echo "OpenBao is already unsealed"
|
|
exit 0
|
|
fi
|
|
|
|
# Unseal using the TPM-decrypted key
|
|
if [ -f "$CREDENTIALS_DIRECTORY/unseal-key" ]; then
|
|
echo "Unsealing OpenBao..."
|
|
UNSEAL_KEY=$(cat "$CREDENTIALS_DIRECTORY/unseal-key")
|
|
bao operator unseal "$UNSEAL_KEY"
|
|
echo "OpenBao unsealed successfully"
|
|
else
|
|
echo "WARNING: Unseal key credential not found, OpenBao remains sealed"
|
|
exit 0 # Don't fail the service, just log the warning
|
|
fi
|
|
'';
|
|
};
|
|
in
|
|
{
|
|
services.openbao = {
|
|
enable = true;
|
|
|
|
settings = {
|
|
ui = true;
|
|
|
|
storage.file.path = "/var/lib/openbao";
|
|
listener.default = {
|
|
type = "tcp";
|
|
address = "0.0.0.0:8200";
|
|
tls_cert_file = "/run/credentials/openbao.service/cert.pem";
|
|
tls_key_file = "/run/credentials/openbao.service/key.pem";
|
|
};
|
|
listener.socket = {
|
|
type = "unix";
|
|
address = "/run/openbao/openbao.sock";
|
|
};
|
|
};
|
|
};
|
|
|
|
systemd.services.openbao.serviceConfig = {
|
|
LoadCredential = [
|
|
"key.pem:/var/lib/openbao/key.pem"
|
|
"cert.pem:/var/lib/openbao/cert.pem"
|
|
];
|
|
# TPM2-encrypted unseal key (created manually, see setup instructions)
|
|
LoadCredentialEncrypted = [
|
|
"unseal-key:/var/lib/openbao/unseal-key.cred"
|
|
];
|
|
# Auto-unseal on service start
|
|
ExecStartPost = "${unsealScript}/bin/openbao-unseal";
|
|
};
|
|
}
|