wild-pc

Files

Paul Payne b437f71300 feat(secrets): OpenBao write path + auto-unseal on boot (Phase 4 hardening)

- SecretBackend gains write/delete/list_names; FileSecretBackend + OpenBaoBackend
  implement them (vault KV-v2 POST/DELETE/LIST); castle-api/secrets.py routes all
  CRUD through the active backend (dashboard writes to the vault in openbao mode)
- add systemd exec_start_post (general; '-' prefix so a hook failure can't fail
  the unit); castle-openbao runs an unseal.sh on boot using OPENBAO_UNSEAL_KEY
- tests: file write/read/list/delete round-trip

Verified live: write→vault→read→list→delete against OpenBao; seal→restart→
auto-unsealed. TLS hardening remains (deferred; gates cross-network/real secrets).

2026-07-07 05:44:23 -07:00

generators

feat(secrets): OpenBao write path + auto-unseal on boot (Phase 4 hardening)

2026-07-07 05:44:23 -07:00

__init__.py

refactor: Migrate CLI and API components to use castle-core for configuration and manifest handling

2026-02-22 22:54:38 -08:00

audit.py

fix(core): audit matches split *_HOST/*_PORT env pairs

2026-07-06 16:57:29 -07:00

config.py

feat(secrets): pluggable secret backend with OpenBao read (Phase 4)