51 lines
2 KiB
SYSTEMD
51 lines
2 KiB
SYSTEMD
|
# OpenBao, as a native systemd service on vps2. Install to
|
||
|
|
# /etc/systemd/system/openbao.service.
|
||
|
|
#
|
||
|
|
# Native, not containerised, on purpose — see the header of config/openbao.hcl. The
|
||
|
|
# whole point is that this unit's only dependency is the local disk: not the Docker
|
||
|
|
# daemon that deploys restart, not the Swarm it would otherwise be deployed by, not
|
||
|
|
# Caddy/ACME for its certificate, and not TimescaleDB.
|
||
|
|
#
|
||
|
|
# Note there is currently NO systemd unit of any kind loaded on either host for
|
||
|
|
# Thermograph (infra/deploy/thermograph.service exists in the repo but is not
|
||
|
|
# installed), so this is the first. That is deliberate: it is the one component that
|
||
|
|
# must survive the container layer being broken.
|
||
|
|
|
||
|
|
[Unit]
|
||
|
|
Description=OpenBao secret store
|
||
|
|
Documentation=https://openbao.org/docs/
|
||
|
|
# network-online rather than plain network: the mesh listener binds 10.10.0.1, and
|
||
|
|
# binding a WireGuard address before the interface is up fails the unit outright.
|
||
|
|
After=network-online.target
|
||
|
|
Wants=network-online.target
|
||
|
|
# Explicitly NOT After=docker.service. Adding it would recreate the dependency this
|
||
|
|
# design exists to avoid.
|
||
|
|
ConditionFileNotEmpty=/etc/openbao/config.hcl
|
||
|
|
|
||
|
|
[Service]
|
||
|
|
User=openbao
|
||
|
|
Group=openbao
|
||
|
|
ExecStart=/usr/local/bin/bao server -config=/etc/openbao/config.hcl
|
||
|
|
ExecReload=/bin/kill --signal HUP $MAINPID
|
||
|
|
KillSignal=SIGINT
|
||
|
|
|
||
|
|
# Restart always, which together with the static seal is what makes a host reboot
|
||
|
|
# self-healing. This pair is the reason deploys are not blocked by a reboot.
|
||
|
|
Restart=always
|
||
|
|
RestartSec=5
|
||
|
|
|
||
|
|
# mlock is disabled in the config (disable_mlock = true), so no IPC_LOCK capability
|
||
|
|
# is needed. If mlock is ever enabled, add: AmbientCapabilities=CAP_IPC_LOCK
|
||
|
|
NoNewPrivileges=yes
|
||
|
|
PrivateTmp=yes
|
||
|
|
ProtectSystem=full
|
||
|
|
ProtectHome=yes
|
||
|
|
# The three paths the service legitimately writes.
|
||
|
|
ReadWritePaths=/var/lib/openbao /var/log/openbao
|
||
|
|
# Raft + audit both do a lot of small writes; the default is too low for a store.
|
||
|
|
LimitNOFILE=65536
|
||
|
|
LimitCORE=0
|
||
|
|
|
||
|
|
[Install]
|
||
|
|
WantedBy=multi-user.target
|