main.yml

---
application_id: "web-app-openbao"
container_port: "{{ lookup('config', application_id, 'services.openbao.ports.internal.http') }}"

OPENBAO_NAME: "{{ lookup('config', application_id, 'services.openbao.name') }}"
OPENBAO_IMAGE: "{{ lookup('config', application_id, 'services.openbao.image') }}"
OPENBAO_VERSION: "{{ lookup('config', application_id, 'services.openbao.version') }}"

OPENBAO_LDAP_PLUGIN_IMAGE: "{{ lookup('config', application_id, 'services.auth-ldap.image') }}"
OPENBAO_LDAP_PLUGIN_VERSION: "{{ lookup('config', application_id, 'services.auth-ldap.version') }}"
OPENBAO_LDAP_PLUGIN_BINARY: "openbao-plugin-auth-ldap"
OPENBAO_PLUGIN_DIR_DOCKER: "/opt/openbao/plugins"
OPENBAO_IMAGE_TAG: "{{ OPENBAO_VERSION }}-auth-ldap-{{ OPENBAO_LDAP_PLUGIN_VERSION }}"

OPENBAO_SSO_ENABLED: "{{ lookup('config', application_id, 'services.sso.enabled') }}"
OPENBAO_LDAP_ENABLED: "{{ lookup('config', application_id, 'services.ldap.enabled') }}"
OPENBAO_PKI_ENABLED: "{{ lookup('config', application_id, 'services.openbao.pki.enabled') }}"
OPENBAO_LOG_LEVEL: "{{ lookup('config', application_id, 'services.openbao.log_level') }}"

OPENBAO_BASE_URL: "{{ lookup('tls', application_id, 'url.origin') }}"

OPENBAO_CONFIG_HOST: "{{ [lookup('container', application_id, 'directories.config'), 'openbao.hcl'] | path_join }}"
OPENBAO_PLUGINS_CONFIG_HOST: "{{ [lookup('container', application_id, 'directories.config'), 'plugins.hcl'] | path_join }}"
OPENBAO_POLICY_DIR_HOST: "{{ [lookup('container', application_id, 'directories.config'), 'policies'] | path_join }}"
OPENBAO_POLICY_DIR_DOCKER: "/openbao/policies"
OPENBAO_DATA_DOCKER: "{{ lookup('volume', application_id, 'data').target }}"

OPENBAO_SEAL_KEY: "{{ lookup('config', application_id, 'secrets.credentials.seal_key') }}"
OPENBAO_APPROLE_ROLE_ID: "{{ lookup('config', application_id, 'secrets.credentials.approle_role_id') }}"
OPENBAO_APPROLE_SECRET_ID: "{{ lookup('config', application_id, 'secrets.credentials.approle_secret_id') }}"

OPENBAO_SEAL_KEY_ID: "{{ (OPENBAO_SEAL_KEY | hash('sha256'))[:16] }}"

OPENBAO_APPLIED_STATE_HOST: "{{ [lookup('container', application_id, 'directories.instance'), '.applied.json'] | path_join }}"
OPENBAO_APPLIED: "{{ openbao_applied_state | default({}, true) }}"
OPENBAO_SEAL_KEY_PREVIOUS: "{{ OPENBAO_APPLIED.seal_key | default('', true) }}"
OPENBAO_SEAL_KEY_PREVIOUS_ID: "{{ (OPENBAO_SEAL_KEY_PREVIOUS | hash('sha256'))[:16] if OPENBAO_SEAL_KEY_PREVIOUS else '' }}"
OPENBAO_SEAL_ROTATING: "{{ (OPENBAO_SEAL_KEY_PREVIOUS | length > 0) and (OPENBAO_SEAL_KEY_PREVIOUS != OPENBAO_SEAL_KEY) }}"

OPENBAO_RECOVERY_TOKEN_APP: "{{ application_id }}-recovery"
OPENBAO_RECOVERY_KEY: >-
  {{ (sys_token_store_users | default({}, true))
     .get(IAM_PLATFORM_ADMIN_USER_KEY, {})
     .get('tokens', {})
     .get(OPENBAO_RECOVERY_TOKEN_APP, '') }}

OPENBAO_SECRET_ID_REGISTERED: "{{ openbao_secret_id_registered | default('', true) }}"
OPENBAO_SECRET_ID_ROTATING: "{{ (OPENBAO_SECRET_ID_REGISTERED | length > 0) and (OPENBAO_SECRET_ID_REGISTERED != OPENBAO_APPROLE_SECRET_ID) }}"
OPENBAO_KV_MOUNT: "infinito"
OPENBAO_AUDIT_PATH: "stdout"
OPENBAO_AUDIT_PROBE: "audit-probe"
OPENBAO_ANSIBLE_APPROLE: "ansible"
OPENBAO_PKI_MOUNT: "pki"
OPENBAO_PKI_ISSUING_ROLE: "internal"
OPENBAO_PKI_ISSUING_URL: "{{ OPENBAO_BASE_URL }}/v1/{{ OPENBAO_PKI_MOUNT }}/ca"
OPENBAO_PKI_CRL_URL: "{{ OPENBAO_BASE_URL }}/v1/{{ OPENBAO_PKI_MOUNT }}/crl"

OPENBAO_OIDC_ISSUER: "{{ OIDC.CLIENT.ISSUER_URL }}"
OPENBAO_OIDC_CLIENT_ID: "{{ OIDC.CLIENT.ID }}"
OPENBAO_OIDC_CLIENT_SECRET: "{{ OIDC.CLIENT.SECRET }}"
OPENBAO_OIDC_USER_CLAIM: "{{ OIDC.ATTRIBUTES.USERNAME }}"
OPENBAO_OIDC_GROUPS_CLAIM: "groups"
OPENBAO_OIDC_DEFAULT_ROLE: "default"

OPENBAO_OIDC_REDIRECT_URIS: >-
  {{ lookup('network_urls', OPENBAO_BASE_URL)
     | product(['/v1/auth/oidc/callback', '/ui/vault/auth/oidc/oidc/callback'])
     | map('join') | join(',') }}

OPENBAO_LDAP_URL: "ldap://{{ LDAP.SERVER.DOMAIN }}:{{ LDAP.SERVER.PORT }}"
OPENBAO_LDAP_USER_ATTR: "{{ LDAP.USER.ATTRIBUTES.ID }}"

OPENBAO_USERPASS_ENABLED: "{{ not (OPENBAO_SSO_ENABLED | bool) and not (OPENBAO_LDAP_ENABLED | bool) }}"
OPENBAO_USERPASS_MOUNT: "userpass"
OPENBAO_USERPASS_MARKER: "infinito-nexus-managed"
OPENBAO_USERPASS_USERNAME: "{{ lookup('users', 'platform_administrator').username }}"
OPENBAO_USERPASS_PASSWORD: "{{ lookup('users', 'platform_administrator').password }}"
OPENBAO_USERPASS_POLICY: "administrator"
OPENBAO_PASSWORD_AUTH_MOUNT: "{{ 'ldap' if OPENBAO_LDAP_ENABLED | bool else (OPENBAO_USERPASS_MOUNT if OPENBAO_USERPASS_ENABLED | bool else '') }}"

OPENBAO_RBAC_ROLES:
  - administrator
  - operator
  - reader