nixos/openbao: init

- Added a NixOS module using RFC42 and plenty of systemd hardening
- Added a NixOS VM Test which checks the basic functionality
- Refactored the package to support HSM and UI

nixos/modules/module-list.nix

@@ -1426,6 +1426,7 @@
   ./services/security/nginx-sso.nix
   ./services/security/oauth2-proxy.nix
   ./services/security/oauth2-proxy-nginx.nix
+  ./services/security/openbao.nix
   ./services/security/opensnitch.nix
   ./services/security/paretosecurity.nix
   ./services/security/pass-secret-service.nix

nixos/modules/services/security/openbao.nix

@@ -0,0 +1,160 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.openbao;
+
+  settingsFormat = pkgs.formats.json { };
+in
+{
+  options = {
+    services.openbao = {
+      enable = lib.mkEnableOption "OpenBao daemon";
+
+      package = lib.mkPackageOption pkgs "openbao" {
+        example = "pkgs.openbao.override { withHsm = false; withUi = false; }";
+      };
+
+      settings = lib.mkOption {
+        description = ''
+          Settings of OpenBao.
+
+          See [documentation](https://openbao.org/docs/configuration) for more details.
+        '';
+        example = lib.literalExpression ''
+          {
+            ui = true;
+
+            listener.default = {
+              type = "tcp";
+              tls_acme_email = config.security.acme.defaults.email;
+              tls_acme_domains = [ "example.com" ];
+              tls_acme_disable_http_challenge = true;
+            };
+
+            cluster_addr = "http://127.0.0.1:8201";
+            api_addr = "https://example.com";
+
+            storage.raft.path = "/var/lib/openbao";
+          }
+        '';
+
+        type = lib.types.submodule {
+          freeformType = settingsFormat.type;
+          options = {
+            ui = lib.mkEnableOption "the OpenBao web UI";
+
+            listener = lib.mkOption {
+              type = lib.types.attrsOf (
+                lib.types.submodule (
+                  { config, ... }:
+                  {
+                    freeformType = settingsFormat.type;
+                    options = {
+                      type = lib.mkOption {
+                        type = lib.types.enum [
+                          "tcp"
+                          "unix"
+                        ];
+                        description = ''
+                          The listener type to enable.
+                        '';
+                      };
+                      address = lib.mkOption {
+                        type = lib.types.str;
+                        default = if config.type == "unix" then "/run/openbao/openbao.sock" else "127.0.0.1:8200";
+                        defaultText = lib.literalExpression ''if config.services.openbao.settings.listener.<name>.type == "unix" then "/run/openbao/openbao.sock" else "127.0.0.1:8200"'';
+                        description = ''
+                          The TCP address or UNIX socket path to listen on.
+                        '';
+                      };
+                    };
+                  }
+                )
+              );
+              description = ''
+                Configure a listener for responding to requests.
+              '';
+            };
+          };
+        };
+      };
+
+      extraArgs = lib.mkOption {
+        type = lib.types.listOf lib.types.str;
+        default = [ ];
+        description = ''
+          Additional arguments given to OpenBao.
+        '';
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = [ cfg.package ];
+
+    systemd.services.openbao = {
+      description = "OpenBao - A tool for managing secrets";
+
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network.target" ];
+
+      restartIfChanged = false; # do not restart on "nixos-rebuild switch". It would seal the storage and disrupt the clients.
+
+      serviceConfig = {
+        Type = "notify";
+
+        ExecStart = lib.escapeShellArgs (
+          [
+            (lib.getExe cfg.package)
+            "server"
+            "-config"
+            (settingsFormat.generate "openbao.hcl.json" cfg.settings)
+          ]
+          ++ cfg.extraArgs
+        );
+        ExecReload = "${lib.getExe' pkgs.coreutils "kill"} -SIGHUP $MAINPID";
+
+        StateDirectory = "openbao";
+        StateDirectoryMode = "0700";
+        RuntimeDirectory = "openbao";
+        RuntimeDirectoryMode = "0700";
+
+        CapabilityBoundingSet = "";
+        DynamicUser = true;
+        LimitCORE = 0;
+        LockPersonality = true;
+        MemorySwapMax = 0;
+        MemoryZSwapMax = 0;
+        PrivateUsers = true;
+        ProcSubset = "pid";
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        Restart = "on-failure";
+        RestrictAddressFamilies = [
+          "AF_INET"
+          "AF_INET6"
+          "AF_UNIX"
+        ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [
+          "@system-service"
+          "@resources"
+          "~@privileged"
+        ];
+        UMask = "0077";
+      };
+    };
+  };
+}