Paul Payne b437f71300 feat(secrets): OpenBao write path + auto-unseal on boot (Phase 4 hardening) ...

- SecretBackend gains write/delete/list_names; FileSecretBackend + OpenBaoBackend
  implement them (vault KV-v2 POST/DELETE/LIST); castle-api/secrets.py routes all
  CRUD through the active backend (dashboard writes to the vault in openbao mode)
- add systemd exec_start_post (general; '-' prefix so a hook failure can't fail
  the unit); castle-openbao runs an unseal.sh on boot using OPENBAO_UNSEAL_KEY
- tests: file write/read/list/delete round-trip

Verified live: write→vault→read→list→delete against OpenBao; seal→restart→
auto-unsealed. TLS hardening remains (deferred; gates cross-network/real secrets).

2026-07-07 05:44:23 -07:00

..

__init__.py

refactor: Migrate CLI and API components to use castle-core for configuration and manifest handling

2026-02-22 22:54:38 -08:00

conftest.py

Manager-first deployment model: split runner, merge service/job, frontend→static

2026-07-01 10:23:03 -07:00

test_apply.py

feat(core): kind-scoped deployment identity (name, kind)

2026-07-06 02:25:05 -07:00

test_audit.py

fix(core): audit matches split *_HOST/*_PORT env pairs

2026-07-06 16:57:29 -07:00

test_caddyfile_remote.py

feat(mesh): cross-node routing + presence breaker (Phase 3)

2026-07-07 05:38:15 -07:00

test_caddyfile.py

feat(core): kind-scoped deployment identity (name, kind)

2026-07-06 02:25:05 -07:00

test_config.py

feat(core): single-source data_dir/repos_dir via castle.yaml

2026-07-06 23:02:33 -07:00

test_deploy_prune.py

feat(core): kind-scoped deployment identity (name, kind)

2026-07-06 02:25:05 -07:00

test_deploy_run_cmd.py

feat: raw-TCP exposure with castle-managed TLS + reach model

2026-07-04 23:04:26 -07:00

test_deploy_secret_env.py

feat(core): kind-scoped deployment identity (name, kind)

2026-07-06 02:25:05 -07:00

test_fleet_role.py

feat(mesh): fleet role + shared config/presence KV (Phase 2)

2026-07-07 05:03:07 -07:00

test_git.py

feat: relationship model (requires/repos/predicates) + git sync

2026-07-05 10:55:42 -07:00

test_kind_identity.py

feat(core): kind-scoped deployment identity (name, kind)

2026-07-06 02:25:05 -07:00

test_lifecycle.py

feat(core): kind-scoped deployment identity (name, kind)

2026-07-06 02:25:05 -07:00

test_manifest.py

feat: raw-TCP exposure with castle-managed TLS + reach model

2026-07-04 23:04:26 -07:00

test_relations.py

feat: deployment-scoped requires + UI editors, gateway nav, services filter

2026-07-06 04:00:24 -07:00

test_resolution.py

Add supabase stack + general compose runner

2026-06-30 18:18:47 -07:00

test_secret_backends.py

feat(secrets): OpenBao write path + auto-unseal on boot (Phase 4 hardening)

2026-07-07 05:44:23 -07:00

test_systemd.py

feat: resolve a program's pinned node version for build + runtime

2026-07-05 19:17:23 -07:00

test_tls.py

feat(core): single-source data_dir/repos_dir via castle.yaml

2026-07-06 23:02:33 -07:00

test_toolchains.py

feat: resolve a program's pinned node version for build + runtime

2026-07-05 19:17:23 -07:00

test_tunnel.py

Manager-first deployment model: split runner, merge service/job, frontend→static

2026-07-01 10:23:03 -07:00