Secrets Management¶

All secrets are managed by OpenBao (self-hosted Vault fork).

Accessing OpenBao¶

URL: https://openbao.heezy.info

This is internal-only — DNS resolves to 192.168.1.25 (SWAG) via dnsmasq. It never touches Cloudflare.

Prerequisite: DNS¶

Your machine must use 192.168.1.29 as its DNS server or openbao.heezy.info won't resolve.

macOS: System Settings → Network → active interface → Details → DNS → add 192.168.1.29

Verify: dig openbao.heezy.info should return 192.168.1.25

Logging In¶

OpenBao uses AppRole for machine auth. For human UI access, generate a short-lived token:

curl -sk -X POST https://openbao.heezy.info/v1/auth/approle/login \
  -H 'Content-Type: application/json' \
  -d '{"role_id":"6d28d688-4a65-d8b5-87bb-f1a9e34d692d","secret_id":"bffc8c5b-d8f6-1597-3465-b2234d23b29c"}' \
  | python3 -c "import sys,json; print(json.load(sys.stdin)['auth']['client_token'])"

In the UI: select Token as the auth method, paste the token. Expires in 1 hour — generate a new one when it expires. The MCP agent can also generate one on demand.

Architecture¶

Browser → https://openbao.heezy.info
  → dnsmasq: openbao.heezy.info → 192.168.1.25 (SWAG MetalLB VIP)
  → SWAG terminates TLS, proxies → openbao.openbao.svc.cluster.local:8200
  → OpenBao pod in openbao namespace

K8s namespace: openbao
Service: openbao ClusterIP + openbao-lb LoadBalancer (192.168.1.32)
SWAG proxy conf: openbao.subdomain.conf in swag-proxy-confs ConfigMap (heezy namespace)
Auto-unseal: CronJob openbao-unseal runs every 5 min — checks seal status and unseals automatically

Secret Layout¶

KV engine: secret/ (KV v2)
Auth: AppRole (machine auth), Token (human/UI access)
ESO policy: eso-readonly — read/list on secret/data/* for External Secrets Operator

Key Paths¶

Path	Contents
`production/heezy/terraform/fortigate/secret`	FortiGate API credentials
`production/heezy/ssh/mcp-admin-private-key`	MCP admin SSH private key
`all/heezy/aws/ecr-credentials`	AWS ECR access keys
`all/heezy/ubuntu/cloud-init-credentials`	Ubuntu VM default credentials
`production/heezy/postgres-credentials`	Postgres credentials
`production/heezy/receipts/aws-credentials`	Textract IAM creds
`production/heezy/gmail/oauth-credentials`	Gmail OAuth tokens
`production/heezy/gitea/runner-pat`	Gitea runner PAT
`production/heezy/cloudflare/pages-token`	Cloudflare Pages deploy token

Grafana¶

Grafana runs on shared-lgtm (192.168.1.10) as a Docker Compose service, not in k8s.

URL: https://grafana.heezy.info
Username: admin
Password: Set via GF_SECURITY_ADMIN_PASSWORD in /opt/lgtm/docker-compose.yml

If you're locked out, reset via:

ssh mcp-admin@192.168.1.10
sudo docker exec grafana /usr/share/grafana/bin/grafana cli admin reset-admin-password <newpassword>

Troubleshooting¶

Can't reach openbao.heezy.info: - Confirm DNS: dig openbao.heezy.info should return 192.168.1.25 - Set DNS to 192.168.1.29 if not

Token expired: - Generate a new one with the curl command above

OpenBao sealed:

curl -sk https://openbao.heezy.info/v1/sys/health | python3 -c "import sys,json; print(json.load(sys.stdin))"
# sealed: false = healthy

The unseal CronJob recovers it automatically within 5 minutes.