OpenBao Raft Cluster Setup Script

This script provides an automated, robust way to deploy and manage a high-availability OpenBao cluster using the Raft (integrated storage) backend. It is designed to work seamlessly in both interactive environments and headless automation pipelines.

Core Functionality

• Internal PKI Management: Generates a self-signed Root CA and node-specific certificates with proper Subject Alternative Names (SANs).
• Cluster Orchestration: Automates the creation of bao.hcl configuration files for any number of nodes.
• Remote Deployment: Uses SSH to push configurations, certificates, and even install Arch Linux packages (.pkg.tar.zst) to remote targets.
• Systemd Integration: Configures OpenBao as a persistent system service with hardened security settings (e.g., CAP_IPC_LOCK).
• Kanidm Synergy:
  • Automatically registers OpenBao as an OAuth2 application in Kanidm.
  • Configures OpenBao's OIDC authentication method to trust Kanidm for identity.
• Logical Precedence: Handles argument execution order automatically (e.g., certificates are always generated before configurations are written).

Headless Execution Example

The script is optimized for CI/CD or configuration management tools. By exporting the required environment variables and using the -E flag with sudo, you can perform a full deployment without manual intervention:
# Define your environment
export BAO_CLUSTER_IPS="10.0.0.1 10.0.0.2 10.0.0.3"
export BAO_SSH_USER="deploy-admin"
export BAO_USE_TLS="y"
export BAO_KANIDM_URL="[https://idm.yourdomain.com](https://idm.yourdomain.com)"
export BAO_PUBLIC_URL="[https://bao.yourdomain.com](https://bao.yourdomain.com)"

# Execute the deployment chain
# This will: Generate a CA, create certs for all IPs, push them over SSH,
# install the Arch package if missing, and configure the systemd service.
sudo -E ./setup_raft.sh --generate-certs --ssh --systemd

Detailed Argument Breakdown

Infrastructure Setup

• --cert-config: Set organizational metadata (Country, Org, etc.) for the CA once. This is an exclusive command.
• --generate-certs: Creates rootCA.crt and node certificates. If --cert-config wasn't run, it will prompt for metadata and save it for future use.
• --init: Configures the local system as a member of a brand-new cluster.
• --new-node: Generates a configuration for a node joining an already existing cluster.

Deployment & Lifecycle

• --ssh: The "Master Controller" mode. Iterates through all IPs in BAO_CLUSTER_IPS to install the binary, push configs, and push certs.
• --systemd: Creates the systemd unit file, reloads the daemon, and enables the service.
• --status: Performs a bao status and checks the Raft peer list (requires the node to be unsealed).

Identity Management

• --kanidm-create-app: Uses the kanidm CLI to create an OAuth2 client, set scopes, and fetch the client secret.
• --kanidm-oidc: Configures the OIDC auth engine inside OpenBao to use Kanidm as the identity provider.

Environment Variables Reference

Variable	Description
BAO_CLUSTER_IPS	Space-separated list of all node IPs in the cluster.
BAO_SSH_USER	The user used to scp and ssh into remote nodes.
BAO_NODE_IP	The IP address of the local machine (bypasses selection prompts).
BAO_NODE_ID	The desired Raft node ID (e.g., node-4).
BAO_USE_TLS	Set to y to force TLS deployment during SSH distribution.
BAO_KANIDM_URL	The full URL of your Kanidm instance.
BAO_PUBLIC_URL	The URL users use to access the OpenBao UI (used for OIDC redirects).

Prerequisites

• Arch Linux: The remote installation feature specifically targets .pkg.tar.zst packages.
• OpenSSL: Required for certificate generation.
• SSH Access: Passwordless sudo or identical usernames across nodes is recommended for --ssh mode.
• Sudo: This script must be run with root privileges to manage system directories.