feat: OpenBao-backed secrets for docker-local and vps by BKJN1 · Pull Request #176 · versolauth/versola

BKJN1 · 2026-08-15T11:01:08Z

Generated configs no longer contain a secret's real value. Every secret
field (JWT signing key, session/cookie secrets, Postgres password, admin
bootstrap password) is written as a ${?VAR} HOCON placeholder instead
(see gen-env.scala's secretField/secretKeyField) — versola-cli resolves
each one against an OpenBao server before starting anything: an existing
value wins over regenerating one, so secrets survive being reconfigured
rather than rotating on every deploy. Companion PR in versola-cli:
versolauth/versola-cli#7.

What's in this PR:

openbao service added to the local docker-compose stack (KV v2 +
AppRole), with a persistent external volume so its data survives a
fresh bundle directory each configure run.
docker-local's auth/central/edge configs placeholder every secret field
instead of writing it literally. This includes the JWT/edge RSA key
pairs' public halves (JWKS, edge's public-key-jwk), not just the
private ones — both halves have to resolve from the same source or a
second configure reuses the old private key from OpenBao while writing
a freshly generated public one, a mismatch that silently broke edge's
sync calls to central (401s) before this was fixed.
A vps branch in gen-env.scala: same placeholder mechanism, but
non-interactive host-network defaults (network_mode: host,
127.0.0.1 addressing, the real id.versola.kz domain) for the one
real VPS this deploys to, plus a vps-only compose template (no
postgres/nginx — both native on the VPS) and a TARGET-aware
entrypoint.sh so one versola-tools image serves both targets.
develop.md: the one-time OpenBao setup procedure (init/unseal/enable
KV+AppRole/policy/role) for both targets, and the vps-specific note on
seeding the real Postgres password before the first deploy (it isn't
something this script can generate — the Postgres role already exists).

Verified locally end-to-end, including a real browser login against the
docker-local stack after a fresh configure.

…cal, resolved via OpenBao

… secrets)

augmentcode · 2026-08-15T11:02:59Z

🤖 Augment PR Summary

Summary: This PR moves docker-local and VPS deployment secret resolution to OpenBao.

Changes:

Generates HOCON environment placeholders and companion candidate dotenv secret files.
Adds a persistent OpenBao service, storage volume, and target-specific listener configuration.
Injects resolved per-service secret dotenv files into auth, central, and edge Compose services.
Adds a non-interactive vps target with host networking and native Postgres/nginx assumptions.
Sets VPS application configs to production mode and binds service/diagnostic ports to loopback.
Preserves generated JWT and edge key-pair identity components through OpenBao-backed resolution.
Updates the tools entrypoint and image build to generate both supported deployment targets.
Documents OpenBao initialization, AppRole setup, migration seeding, and operational constraints.

Technical Notes: The external OpenBao volume is intended to survive fresh deployment bundle directories; VPS configuration expects existing production secrets to be seeded before its first run.

_{🤖 Was this summary useful? React with 👍 or 👎}

augmentcode

Review completed. 1 suggestion posted.

Comment augment review to trigger a new review at any time.

augmentcode · 2026-08-15T11:03:00Z

+}
+
+listener "tcp" {
+  address     = "0.0.0.0:8200"


This listener binds OpenBao’s unauthenticated/TLS-disabled API to every interface; with the vps fragment’s host network, port 8200 is consequently reachable on the VPS public interfaces, contrary to the deployment contract that nothing binds to 0.0.0.0. The docker-local fragment also publishes it on all host interfaces, so AppRole credentials and secret API traffic can be exposed or observed outside the intended local host.

Severity: high

Other Locations

docker/versola-tools/compose.fragment.yml.template:37

_{🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.}

…st/VPS interfaces)

BKJN1 · 2026-08-15T11:21:30Z

augment review

augmentcode

Review completed. 1 suggestion posted.

Comment augment review to trigger a new review at any time.

augmentcode · 2026-08-15T11:25:30Z

+    platform: linux/amd64
+    container_name: versola-central
+    restart: unless-stopped
+    network_mode: host


At docker/versola-tools/compose.fragment.vps.yml.template:46, host networking makes central use the host namespace, while VersolaApp only calls Server.Config.default.port, whose default bind address is 0.0.0.0; ports 8090/8091 can therefore be reached directly on any network path to the VPS, bypassing nginx and its TLS/access controls. The same exposure applies to auth and edge.

Severity: high

Other Locations

docker/versola-tools/compose.fragment.vps.yml.template:70

docker/versola-tools/compose.fragment.vps.yml.template:87

_{🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.}

…s public interface, bypassing nginx)

BKJN1 · 2026-08-15T11:54:02Z

augment review

augmentcode

Review completed. 3 suggestions posted.

Comment augment review to trigger a new review at any time.

augmentcode · 2026-08-15T11:57:17Z

+        "SESSION_COOKIE_SECRET"      -> sessionCookieSecret,
+        "USER_AGENT_COOKIE_SECRET"   -> userAgentCookieSecret,
+        "PAR_REQUESTS_SECRET"        -> parRequestsSecret,
+        "JWT_PRIVATE_KEY"            -> jwtKey.privateB64,


When OpenBao is initialized for the already-running VPS, this stores a newly generated private key while the existing jwks table retains its prior key. Bootstrap adds the new JWK, but auth signs with JWT.PublicKeys.active (the first, unordered persisted record), so it can put the old kid on a token signed by this new private key and validators will reject it.

Severity: high

_{🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.}

augmentcode · 2026-08-15T11:57:17Z

+      val centralExtras = if isVps then Seq("POSTGRES_PASSWORD" -> centralPgPass) else Seq.empty
+      writeGeneratedSecrets(dir, "central.generated-secrets.env", Seq(
+        "CENTRAL_SECRET_KEY"    -> centralSecretKey,
+        "CLIENT_SECRETS_SECRET" -> clientSecretsSecret,


A first VPS setup against an empty OpenBao generates a new CLIENT_SECRETS_SECRET even though the existing central resource secret remains encrypted under the prior key. Bootstrap skips that existing resource, so central cannot recover its credential to sync to edge and the edge admin proxy becomes unavailable after this rollout.

Severity: high

_{🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.}

augmentcode · 2026-08-15T11:57:17Z

+
+      val edgeExtras = if isVps then Seq("POSTGRES_PASSWORD" -> edgePgPass) else Seq.empty
+      writeGeneratedSecrets(dir, "edge.generated-secrets.env", Seq(
+        "EDGE_PRIVATE_KEY"     -> edgeKey.privateB64,


EDGE_PRIVATE_KEY is persisted without its paired key identity. On the initial migration central retains the existing edge-default public JWK, and on a later run the literal key-id is regenerated from the date while this private key is reused; either case makes the sync token's KID/key differ from central's persisted public key, causing edge-to-central syncs to return 401.

Severity: high

_{🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.}

…ocument seeding real crypto material for vps migration

BKJN1 · 2026-08-15T13:38:41Z

augment review

augmentcode

Review completed. 1 suggestion posted.

Comment augment review to trigger a new review at any time.

augmentcode · 2026-08-15T13:41:34Z

+  // Unlike docker-local's throwaway Postgres container, the VPS's Postgres
+  // role already exists outside this script's control -- see the comment
+  // on pgPassDefault below.
+  val isVps = env == "vps"


vps is emitted verbatim as env, but VersolaApp.envName recognizes only "prod" as EnvName.Prod, so this real VPS runs as Test("vps"). That makes OTPs deterministic and not delivered, and enables test-only service endpoints, so the deployment cannot safely serve production traffic.

Severity: high

_{🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.}

…ocument seeding real crypto material for vps migration

BKJN1 · 2026-08-15T14:37:00Z

augment review

augmentcode

Review completed. 1 suggestion posted.

Comment augment review to trigger a new review at any time.

augmentcode · 2026-08-15T14:42:11Z

+# stop them. A stable name fixes both: Compose looks containers up by
+# project+service, not by which file path happened to describe them this
+# time, so any bundle directory's compose file manages the same stack.
+name: versola-local


Existing docker-local stacks were created under bundle-derived project names, while their containers already use these fixed names; changing the project to versola-local cannot adopt them. The first post-upgrade configure/up will therefore fail with container-name conflicts before this stable name can help. Other locations where this applies: docker/versola-tools/compose.fragment.vps.yml.template:32 (the documented existing VPS stack is an implicit versola project).

Severity: high

Other Locations

docker/versola-tools/compose.fragment.vps.yml.template:32

_{🤖 Was this useful? React with 👍 or 👎, or 🚀 if it prevented an incident/outage.}

… a pre-existing deployment

BKJN1 · 2026-08-15T15:14:24Z

augment review

augmentcode

Review completed. No suggestions at this time.

Comment augment review to trigger a new review at any time.

BKJN1 added 5 commits August 15, 2026 15:45

tools: add OpenBao to the local docker-local compose stack

e7fd979

gen-env: placeholder secrets (incl. paired public keys) for docker-lo…

941cbd7

…cal, resolved via OpenBao

feat: vps env branch in gen-env.scala (host-network defaults, OpenBao…

634eb80

… secrets)

feat: vps compose template + TARGET-aware entrypoint in versola-tools

7ae916e

docs: document OpenBao one-time setup for docker-local and vps

ace597b

augmentcode Bot reviewed Aug 15, 2026

View reviewed changes

BKJN1 mentioned this pull request Aug 15, 2026

feat: OpenBao-backed secrets, vps target support versolauth/versola-cli#7

Open

fix: restrict OpenBao's listener to loopback (was reachable on all ho…

b916142

…st/VPS interfaces)

augmentcode Bot reviewed Aug 15, 2026

View reviewed changes

fix: bind auth/central/edge to loopback on vps (was reachable on VPS'…

02b4acd

…s public interface, bypassing nginx)

augmentcode Bot reviewed Aug 15, 2026

View reviewed changes

fix: keep edge key-id paired with its OpenBao-resolved private key; d…

14a9bdd

…ocument seeding real crypto material for vps migration

augmentcode Bot reviewed Aug 15, 2026

View reviewed changes

fix: keep edge key-id paired with its OpenBao-resolved private key; d…

dd8c28f

…ocument seeding real crypto material for vps migration

augmentcode Bot reviewed Aug 15, 2026

View reviewed changes

docs: warn about container-name conflict on first vps configure after…

8c6ea6d

… a pre-existing deployment

augmentcode Bot reviewed Aug 15, 2026

View reviewed changes

Uh oh!

Conversation

BKJN1 commented Aug 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

augmentcode Bot commented Aug 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

augmentcode Bot left a comment

Choose a reason for hiding this comment

Uh oh!

augmentcode Bot Aug 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

BKJN1 commented Aug 15, 2026

Uh oh!

augmentcode Bot left a comment

Choose a reason for hiding this comment

Uh oh!

augmentcode Bot Aug 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

BKJN1 commented Aug 15, 2026

Uh oh!

augmentcode Bot left a comment

Choose a reason for hiding this comment

Uh oh!

augmentcode Bot Aug 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

augmentcode Bot Aug 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

augmentcode Bot Aug 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

BKJN1 commented Aug 15, 2026

Uh oh!

augmentcode Bot left a comment

Choose a reason for hiding this comment

Uh oh!

augmentcode Bot Aug 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

BKJN1 commented Aug 15, 2026

Uh oh!

augmentcode Bot left a comment

Choose a reason for hiding this comment

Uh oh!

augmentcode Bot Aug 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

BKJN1 commented Aug 15, 2026

Uh oh!

augmentcode Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

BKJN1 commented Aug 15, 2026 •

edited

Loading

augmentcode Bot commented Aug 15, 2026 •

edited

Loading

augmentcode Bot Aug 15, 2026 •

edited

Loading

augmentcode Bot Aug 15, 2026 •

edited

Loading

augmentcode Bot Aug 15, 2026 •

edited

Loading

augmentcode Bot Aug 15, 2026 •

edited

Loading

augmentcode Bot Aug 15, 2026 •

edited

Loading

augmentcode Bot Aug 15, 2026 •

edited

Loading

augmentcode Bot Aug 15, 2026 •

edited

Loading