mirror of
https://gitlab.kube.huskypup.net/Scooby/Homelabv4.git
synced 2026-08-21 11:36:50 +00:00
Scooby HuskyandClaude Sonnet 5
d0c5563671
Single-node Vault (raft storage, standalone mode) plus a restore CronJob that pulls the latest raft snapshot from the VPS's own local MinIO (already receiving snapshots every 6h from home) and restores it every 6h, offset 30 minutes after the home-side snapshot job. Not an independent root of trust: raft snapshot restore replaces the entire storage backend including the keyring, so after every restore this Vault is sealed with HOME's actual keyring - unsealing it needs a copy of home's real unseal key, stored directly on the VPS cluster (kubectl, not git, same pattern as vps-minio-root-secret). First-run bootstrap uses a throwaway single-Shamir-key init just to get through the very first restore, then is irrelevant from then on. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
56 lines
1.6 KiB
YAML
56 lines
1.6 KiB
YAML
# Vault warm standby on the VPS - Phase 2 of the VPS plan.
|
|
#
|
|
# This is NOT an independent Vault with its own root of trust. It exists
|
|
# purely to periodically absorb home Vault's raft snapshots (already
|
|
# flowing to this VPS's own MinIO via infrastructure/vault/manifests/
|
|
# raft-snapshot-cronjob.yaml) so it can be promoted quickly during a real
|
|
# home outage. See manifests/restore-cronjob.yaml for the restore loop.
|
|
#
|
|
# Deliberately scoped-down from home Vault's offline-Shamir-share posture:
|
|
# single node, single-key auto-unseal via a key copied to this cluster
|
|
# (kubectl, not git - see manifests/restore-cronjob.yaml's header comment
|
|
# for why a copy of the real key, not a fresh one, is required here).
|
|
# Acceptable because this is a read-only standby, not the root of trust,
|
|
# and there's no independent data at stake - restoring a raft snapshot
|
|
# overwrites everything here with home's actual state (and keyring) on
|
|
# every cycle.
|
|
server:
|
|
standalone:
|
|
enabled: true
|
|
config: |
|
|
ui = true
|
|
listener "tcp" {
|
|
address = "0.0.0.0:8200"
|
|
tls_disable = 1
|
|
}
|
|
storage "raft" {
|
|
path = "/vault/data"
|
|
}
|
|
disable_mlock = true
|
|
|
|
ha:
|
|
enabled: false
|
|
|
|
dataStorage:
|
|
enabled: true
|
|
size: 5Gi
|
|
storageClass: local-path
|
|
|
|
resources:
|
|
requests:
|
|
cpu: 50m
|
|
memory: 128Mi
|
|
limits:
|
|
memory: 512Mi
|
|
|
|
# No ingress/public exposure - reached over Netbird from home while it's
|
|
# up, or directly on the VPS during an actual promoted-standby incident.
|
|
service:
|
|
enabled: true
|
|
|
|
injector:
|
|
enabled: false # no sidecar-injection use case on a restore-only standby
|
|
|
|
ui:
|
|
enabled: true
|