docker-openbao

Déploiement Docker d'OpenBao — gestionnaire de secrets auto-hébergé, stockage Raft, exposé via Traefik et Cloudflare Tunnel.

A propos de

Prérequis

Vous avez besoin d'une installation docker fonctionnelle et de docker-compose sur votre machine.

Démarrage

  git clone https://gitea.tips-of-mine.com/Tips-Of-Mine/docker-openbao.git
  cd docker-openbao

Personnalisation

Le fichier .env pour les variable d'environnement

  nano .env

Modification des labels pour traefik

  nano docker-compose.yml

Lancement

  docker compose up -d

  docker compose logs -f

Configuration

init

  docker exec -it openbao-app bao operator init -key-shares=3 -key-threshold=2

unseal

docker exec -it openbao-app bao operator unseal
docker exec -it openbao-app bao operator unseal

check

  docker exec -it openbao-app bao login
  docker exec -it openbao-app bao audit list -detailed
  docker exec openbao-app ls -l /openbao/logs/

creation secret

  docker exec -it openbao-app bao secrets enable -path=secret -version=2 kv
  docker exec -it openbao-app bao secrets list -detailed

creation policy

  docker exec -i openbao-app bao policy write terraform - <<'EOF'
  # Lecture du secret Cloudflare utilisé par Terraform
  path "secret/data/cloudflare" {
    capabilities = ["read"]
  }

  # Métadonnées et versions du même secret
  path "secret/metadata/cloudflare" {
    capabilities = ["read", "list"]
  }
  EOF

docker exec -it openbao-app bao policy read terraform

bascule de Vault vers openbao

  for s in authentik aws cloudflare mysecret; do
    docker exec 3710711b3c37 vault read -format=json "secret/$s" \
      | jq -c '.data' \
      | docker exec -i openbao-app bao kv put -mount=secret "$s" - \
      && echo "OK $s"
  done

check

  docker exec -it openbao-app bao kv list secret/
  docker exec -it openbao-app bao kv metadata get -mount=secret cloudflare

creation de compte

  docker exec -it openbao-app bao auth enable approle

  docker exec -it openbao-app bao write auth/approle/role/terraform \
    token_policies="terraform" \
    token_ttl=20m \
    token_max_ttl=1h \
    secret_id_ttl=0 \
    secret_id_num_uses=0

  docker exec -it openbao-app bao read auth/approle/role/terraform

  docker exec -it 3710711b3c37 vault list terraform/role
  docker exec -it 3710711b3c37 vault list identity/entity/id

PKI

init

  docker exec -it openbao-app bao secrets enable pki
  docker exec -it openbao-app bao secrets tune -max-lease-ttl=87600h pki
  docker exec -it openbao-app bao secrets list | grep pki

  docker exec -it openbao-app bao write -field=certificate pki/root/generate/internal \
    common_name="Tips Of Mine Root CA" \
    issuer_name="root-2026" \
    key_type="ec" \
    key_bits=384 \
    ttl=87600h > /root/ca-root.crt

  docker exec -it openbao-app bao write pki/config/urls \
    issuing_certificates="https://openbao.tips-of-mine.com/v1/pki/ca" \
    crl_distribution_points="https://openbao.tips-of-mine.com/v1/pki/crl"

  docker exec -it openbao-app bao secrets enable -path=pki_int pki
  docker exec -it openbao-app bao secrets tune -max-lease-ttl=43800h pki_int

  # génération de la demande, signature par la racine, réinjection — en une passe
  docker exec -i openbao-app sh <<'EOF'
  set -e
  bao write -field=csr pki_int/intermediate/generate/internal \
    common_name="Tips Of Mine Intermediate CA" \
    issuer_name="int-2026" key_type=ec key_bits=384 > /tmp/int.csr
  bao write -field=certificate pki/root/sign-intermediate \
    csr=@/tmp/int.csr format=pem_bundle ttl=43800h > /tmp/int.crt
  bao write pki_int/intermediate/set-signed certificate=@/tmp/int.crt
  rm -f /tmp/int.csr /tmp/int.crt
  EOF

  docker exec -it openbao-app bao write pki_int/config/urls \
    issuing_certificates="https://openbao.tips-of-mine.com/v1/pki_int/ca" \
    crl_distribution_points="https://openbao.tips-of-mine.com/v1/pki_int/crl"

  docker exec -it openbao-app bao write pki_int/roles/tips-of-mine \
    allowed_domains="tips-of-mine.com,tips-of-mine.org" \
    allow_subdomains=true \
    allow_bare_domains=true \
    key_type="ec" key_bits=256 \
    max_ttl="2160h"

  docker exec -it openbao-app bao write pki_int/issue/tips-of-mine \
    common_name="test.tips-of-mine.org" ttl="24h"

Buy me a coffe