mirror of
https://github.com/community-scripts/ProxmoxVE.git
synced 2026-09-01 02:53:16 +02:00
push-app-to-main[bot]
68 lines
1.9 KiB
Bash
Executable File
68 lines
1.9 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Copyright (c) 2021-2026 community-scripts ORG
|
|
# Author: Marc Went (Dunky13)
|
|
# License: MIT | https://github.com/community-scripts/ProxmoxVE/raw/main/LICENSE
|
|
# Source: https://openbao.org/
|
|
|
|
source /dev/stdin <<<"$FUNCTIONS_FILE_PATH"
|
|
color
|
|
verb_ip6
|
|
catch_errors
|
|
setting_up_container
|
|
network_check
|
|
update_os
|
|
|
|
fetch_and_deploy_gh_release "openbao" "openbao/openbao" "binary" "latest" "/opt/openbao" "openbao_*_linux_$(arch_resolve).deb"
|
|
|
|
msg_info "Configuring CLI Environment"
|
|
cat <<EOF >/etc/profile.d/openbao.sh
|
|
export BAO_ADDR=https://127.0.0.1:8200
|
|
export BAO_SKIP_VERIFY=true
|
|
EOF
|
|
source /etc/profile.d/openbao.sh
|
|
msg_ok "Configured CLI Environment"
|
|
|
|
msg_info "Starting OpenBao"
|
|
systemctl enable -q --now openbao
|
|
for _ in {1..30}; do
|
|
curl -fsSk -o /dev/null "https://127.0.0.1:8200/v1/sys/seal-status" && break
|
|
sleep 2
|
|
done
|
|
msg_ok "Started OpenBao"
|
|
|
|
msg_info "Initializing OpenBao"
|
|
(
|
|
umask 077
|
|
cat <<'EOF' >/etc/openbao/openbao-init.json
|
|
EOF
|
|
)
|
|
bao operator init -key-shares=1 -key-threshold=1 -format=json >/etc/openbao/openbao-init.json
|
|
chmod 600 /etc/openbao/openbao.env
|
|
chown root:root /etc/openbao/openbao.env
|
|
cat <<EOF >>/etc/openbao/openbao.env
|
|
BAO_ADDR=https://127.0.0.1:8200
|
|
BAO_SKIP_VERIFY=true
|
|
BAO_UNSEAL_KEY=$(jq -r '.unseal_keys_b64[0]' /etc/openbao/openbao-init.json)
|
|
BAO_ROOT_TOKEN=$(jq -r '.root_token' /etc/openbao/openbao-init.json)
|
|
EOF
|
|
rm -f /etc/openbao/openbao-init.json
|
|
msg_ok "Initialized OpenBao"
|
|
|
|
msg_info "Enabling Auto-Unseal"
|
|
mkdir -p /etc/systemd/system/openbao.service.d
|
|
cat <<'EOF' >/etc/systemd/system/openbao.service.d/unseal.conf
|
|
[Service]
|
|
ExecStartPost=-/usr/bin/bao operator unseal ${BAO_UNSEAL_KEY}
|
|
EOF
|
|
systemctl daemon-reload
|
|
systemctl restart openbao
|
|
for _ in {1..15}; do
|
|
bao status -format=json 2>/dev/null | jq -e '.sealed == false' >/dev/null && break
|
|
sleep 2
|
|
done
|
|
msg_ok "Enabled Auto-Unseal"
|
|
|
|
motd_ssh
|
|
customize
|
|
cleanup_lxc
|