OpenBao (#16872)

install/openbao-install.sh

@@ -0,0 +1,67 @@
+#!/usr/bin/env bash
+# Copyright (c) 2021-2026 community-scripts ORG
+# Author: Marc Went (Dunky13)
+# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
+# Source: https://openbao.org/
+
+source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
+color
+verb_ip6
+catch_errors
+setting_up_container
+network_check
+update_os
+
+fetch_and_deploy_gh_release "openbao" "openbao/openbao" "binary" "latest" "/opt/openbao" "openbao_*_linux_$(arch_resolve).deb"
+
+msg_info "Configuring CLI Environment"
+cat <<EOF >/etc/profile.d/openbao.sh
+export BAO_ADDR=https://127.0.0.1:8200
+export BAO_SKIP_VERIFY=true
+EOF
+source /etc/profile.d/openbao.sh
+msg_ok "Configured CLI Environment"
+
+msg_info "Starting OpenBao"
+systemctl enable -q --now openbao
+for _ in {1..30}; do
+  curl -fsSk -o /dev/null "https://127.0.0.1:8200/v1/sys/seal-status" && break
+  sleep 2
+done
+msg_ok "Started OpenBao"
+
+msg_info "Initializing OpenBao"
+(
+  umask 077
+  cat <<'EOF' >/etc/openbao/openbao-init.json
+EOF
+)
+bao operator init -key-shares=1 -key-threshold=1 -format=json >/etc/openbao/openbao-init.json
+chmod 600 /etc/openbao/openbao.env
+chown root:root /etc/openbao/openbao.env
+cat <<EOF >>/etc/openbao/openbao.env
+BAO_ADDR=https://127.0.0.1:8200
+BAO_SKIP_VERIFY=true
+BAO_UNSEAL_KEY=$(jq -r '.unseal_keys_b64[0]' /etc/openbao/openbao-init.json)
+BAO_ROOT_TOKEN=$(jq -r '.root_token' /etc/openbao/openbao-init.json)
+EOF
+rm -f /etc/openbao/openbao-init.json
+msg_ok "Initialized OpenBao"
+
+msg_info "Enabling Auto-Unseal"
+mkdir -p /etc/systemd/system/openbao.service.d
+cat <<'EOF' >/etc/systemd/system/openbao.service.d/unseal.conf
+[Service]
+ExecStartPost=-/usr/bin/bao operator unseal ${BAO_UNSEAL_KEY}
+EOF
+systemctl daemon-reload
+systemctl restart openbao
+for _ in {1..15}; do
+  bao status -format=json 2>/dev/null | jq -e '.sealed == false' >/dev/null && break
+  sleep 2
+done
+msg_ok "Enabled Auto-Unseal"
+
+motd_ssh
+customize
+cleanup_lxc