spikerj/spikersoft-issues
1
0
Fork 0
Code Issues 196 Pull Requests Actions Packages Projects Releases Wiki Activity

[Security][Infra] OpenBao Phase 0: swarm stack + init/unseal runbook + Keycloak OIDC (epic #543) #544

New Issue
Closed
opened 2026-07-13 21:07:24 +00:00 by spikerj · 3 comments
spikerj commented 2026-07-13 21:07:24 +00:00
Owner
Copy Link
Copy Source

Deploy openbao/openbao:2.5.5 (verified tag): single-node Raft on SERVER NVMe (/home/joey/docker/openbao — NOT fusionio, #503 lesson), Traefik at bao.spikersoft.com, disable_mlock (container norm), restart condition:any + a SEALED-TOLERANT healthcheck (sys/health?sealedcode=204&uninitcode=204 — a sealed vault awaiting manual unseal must NOT flap the task; the MinIO #54 lesson). Runbook: init 3-of-2 shares held offline, audit device to stdout (docker logs → Seq), KV v2 mount, AppRole auth, Keycloak OIDC for humans. Infra PR is GATED on DNS + the runbook's one-time init.

Deploy openbao/openbao:2.5.5 (verified tag): single-node Raft on SERVER NVMe (/home/joey/docker/openbao — NOT fusionio, #503 lesson), Traefik at bao.spikersoft.com, disable_mlock (container norm), restart condition:any + a SEALED-TOLERANT healthcheck (sys/health?sealedcode=204&uninitcode=204 — a sealed vault awaiting manual unseal must NOT flap the task; the MinIO #54 lesson). Runbook: init 3-of-2 shares held offline, audit device to stdout (docker logs → Seq), KV v2 mount, AppRole auth, Keycloak OIDC for humans. Infra PR is GATED on DNS + the runbook's one-time init.
spikerj commented 2026-07-13 21:09:30 +00:00
Author
Owner
Copy Link
Copy Source

Infra PR #61 (GATED): openbao/docker-stack.yml (2.5.5 pinned+verified, SERVER NVMe raft, sealed-tolerant healthcheck per the MinIO #54 lesson, Traefik at bao.spikersoft.com) + docs/openbao-init-runbook.md (init/unseal, audit, KV v2, AppRole policy sketch, Keycloak OIDC, snapshot backups, Phase-1 migration table). Gates: DNS record, host mkdir, one-time init with OFFLINE shares.

Infra PR #61 (GATED): openbao/docker-stack.yml (2.5.5 pinned+verified, SERVER NVMe raft, sealed-tolerant healthcheck per the MinIO #54 lesson, Traefik at bao.spikersoft.com) + docs/openbao-init-runbook.md (init/unseal, audit, KV v2, AppRole policy sketch, Keycloak OIDC, snapshot backups, Phase-1 migration table). Gates: DNS record, host mkdir, one-time init with OFFLINE shares.
spikerj commented 2026-07-15 16:19:15 +00:00
Author
Owner
Copy Link
Copy Source

Progress update (2026-07-15) — Phase 0 is deployed and OIDC is live.

  • Stack deployed: 3-node Raft HA (openbao-1/2/3 on dreamstream1/3/4) behind an nginx router (only the router on traefik-public); https://bao.spikersoft.com live, initialized, unsealed. Init/unseal + day-one runbook in docs/openbao-init-runbook.md.
  • Day-one config done: audit device, KV v2 (secret/), AppRole, rate-limit quotas (global + login).
  • Keycloak OIDC human SSO working, locked to the bao-admins group (bound_claims), verified both ways (member gets admin; non-member denied at login).

Fixes landed while bringing OIDC up (all merged to master):

  • PR #95 — added the missing admin policy (the OIDC role granted a non-existent policy) + corrected the discovery-URL host (ids.spikersoft.com, not auth.).
  • PR #96 — write the admin policy via stdin (docker exec -i), not a container-invisible host path.
  • PR #97 — outbound-only openbao-egress overlay so the vault nodes (previously on an internal:true-only network) can reach Keycloak for OIDC discovery/JWKS.
  • PR #98 — document the group-locked admin-sso role.

Sole remaining Phase-0 item: revoke the initial root token (runbook step 6) once we're satisfied — irreversible short of regenerating root from the offline unseal shares. Holding on that pending sign-off. Everything else here is complete.

**Progress update (2026-07-15) — Phase 0 is deployed and OIDC is live.** - Stack deployed: 3-node Raft HA (`openbao-1/2/3` on dreamstream1/3/4) behind an nginx router (only the router on `traefik-public`); `https://bao.spikersoft.com` live, initialized, unsealed. Init/unseal + day-one runbook in `docs/openbao-init-runbook.md`. - Day-one config done: audit device, KV v2 (`secret/`), AppRole, rate-limit quotas (global + login). - **Keycloak OIDC human SSO working**, locked to the `bao-admins` group (`bound_claims`), verified both ways (member gets `admin`; non-member denied at login). Fixes landed while bringing OIDC up (all merged to master): - PR #95 — added the missing `admin` policy (the OIDC role granted a non-existent policy) + corrected the discovery-URL host (`ids.spikersoft.com`, not `auth.`). - PR #96 — write the admin policy via stdin (`docker exec -i`), not a container-invisible host path. - PR #97 — **outbound-only `openbao-egress` overlay** so the vault nodes (previously on an `internal:true`-only network) can reach Keycloak for OIDC discovery/JWKS. - PR #98 — document the group-locked `admin-sso` role. **Sole remaining Phase-0 item:** revoke the initial root token (runbook step 6) once we're satisfied — irreversible short of regenerating root from the offline unseal shares. Holding on that pending sign-off. Everything else here is complete.
spikerj commented 2026-07-15 20:22:28 +00:00
Author
Owner
Copy Link
Copy Source

Phase 0 complete. OpenBao 3-node Raft HA deployed + initialized, bao.spikersoft.com live, audit + rate-limit quotas configured, Keycloak OIDC with group-locked admin-sso working, and the initial root token revoked (day-one step 6) — unseal shares + root stay offline with the operator, never in Bao/git. Closing.

Phase 0 complete. OpenBao 3-node Raft HA deployed + initialized, bao.spikersoft.com live, audit + rate-limit quotas configured, Keycloak OIDC with group-locked admin-sso working, and the initial **root token revoked** (day-one step 6) — unseal shares + root stay offline with the operator, never in Bao/git. Closing.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
agentic
Actionable surfaced by the agentic architecture & security review
 bug
Something is not working
 duplicate
This issue or pull request already exists
 enhancement
New feature
 help wanted
Need some help
 invalid
Something is wrong
 question
More information is needed
 sonarqube
Code quality issue surfaced by SonarQube (bug / code smell)
 wontfix
This won't be fixed
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
spikerj (Joseph Spiker)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: spikerj/spikersoft-issues#544