ScottyLabs/infrastructure
Watch
13
0
Fork
You've already forked infrastructure
 3
Code Issues 41 Pull requests 5 Projects Releases Packages Wiki Activity Actions

Auto-unseal OpenBao on infra-01 with the kms-pkcs11 plugin #27

New issue
Open
opened 2026-07-11 18:11:01 +00:00 by thesuperRL · 0 comments
thesuperRL commented 2026-07-11 18:11:01 +00:00 (Migrated from codeberg.org)
Copy link

Currently, there's nothing auto-unsealing OpenBao when the VM restarts. You have to go in and manually 3 of the 5 unseal keys.

nixpkgs just added pkgs.openbaoPlugins.kms-pkcs11, which the NixOS module can register through services.openbao.plugins.

Paired with tpm2-pkcs11, OpenBao could unseal itself using a key held in the VM's TPM.

We need a seal "pkcs11" block pointing at the token, and then we can migrate the seal with bao operator unseal -migrate using the current unseal keys.

Currently, there's nothing auto-unsealing OpenBao when the VM restarts. You have to go in and manually 3 of the 5 unseal keys. nixpkgs just added `pkgs.openbaoPlugins.kms-pkcs11`, which the NixOS module can register through `services.openbao.plugins`. Paired with `tpm2-pkcs11`, OpenBao could unseal itself using a key held in the VM's TPM. We need a `seal "pkcs11"` block pointing at the token, and then we can migrate the seal with `bao operator unseal -migrate` using the current unseal keys.
anish changed title from Auto-unseal OpenBao to Auto-unseal OpenBao on infra-01 with the kms-pkcs11 plugin 2026-10-05 17:51:24 +00:00
anish self-assigned this 2026-10-14 06:19:37 +00:00
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
renovate/lockfiles
renovate/kennel
refactor/sops-nix
fix/vault-agent-file-paths
fix/ci-semgrep-aarch64
crawler-archive-disk
No results found.
Labels
Clear labels
  
needs/docs
Must have documentation written

  
needs/research
Discuss the ideal implementation with the tech lead

  
needs/upstream
Needs a contribution to an upstream project

  
type/bug
Something not working as intended

  
type/external
Lives outside of code

  
type/feature
New functionality

  
type/refactor
Improving existing code

  
urgency
high
 This is currently causing issues

  
urgency
immediate
 This is making a project or feature unusable

  
urgency
low
 This can happen whenever

  
urgency
medium
 This is expected to cause issues soon

No labels
needs/docs
needs/research
needs/upstream
type/bug
type/external
type/feature
type/refactor
urgency
high
urgency
immediate
urgency
low
urgency
medium
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
DevOps TODO
Assignees
Clear assignees
No assignees
anish
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
ScottyLabs/infrastructure#27
No description provided.