coulomb/audit-core
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Pin attended sender mint to the operator OpenBao tunnel

Browse source 
Public bao.coulomb.social was retracted today and now presents
Traefik's default certificate. Login must use http://127.0.0.1:18200
via openbao-attended-exec.py, matching the sitting-requester path.

Assistant: grok
Assistant-Session: 01a0a182-bab7-7f11-b32b-d06f3af52082
This commit is contained in:
tegwick 2026-09-15 21:59:28 +02:00
parent 7c0f270b44
commit ede59ba8fb
3 changed files with 44 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

15
scripts/attended-mint-tenant-engine-sender.sh
View file

@ -1,17 +1,12 @@
#!/usr/bin/env bash
# Parent-env wrapper for the attended tenant-engine sender mint.
#
# `warden access` runs OIDC from the *caller* environment, not from the
# `env ...` child argv. BAO_ADDR must be set here or bao login talks to
# the wrong address and fails before the mint script starts.
# Public https://bao.coulomb.social was retracted 2026-09-15
# (RMASTER-WP-0020-T09). Operator login is the named tunnel
# openbao-ui-railiance01 → http://127.0.0.1:18200. railiance-platform's
# openbao-attended-exec.py pins that address for both OIDC and the child.
set -euo pipefail
export BAO_ADDR="${BAO_ADDR:-https://bao.coulomb.social}"
export VAULT_ADDR="${VAULT_ADDR:-$BAO_ADDR}"
export RAILIANCE01_KUBECONFIG="${RAILIANCE01_KUBECONFIG:-$HOME/.kube/config-railiance01}"
export WARDEN_ROUTING_CATALOG="${WARDEN_ROUTING_CATALOG:-$HOME/ops-warden/registry/routing/catalog.yaml}"
cd "$(dirname "$0")/.."
exec warden access openbao-platform-admin-login --exec -- \
env RAILIANCE01_KUBECONFIG="$RAILIANCE01_KUBECONFIG" \
BAO_ADDR="$BAO_ADDR" \
VAULT_ADDR="$VAULT_ADDR" \
exec python3 /home/worsch/railiance-platform/scripts/openbao-attended-exec.py -- \
"$PWD/scripts/mint-tenant-engine-sender.py"