IsoHex/edge-router
Watch
1
0
Fork
You've already forked edge-router
 0
Code Issues 11 Pull requests Releases 2 Packages 1 Activity Actions

Requirements to route OpenBao host access through edge-router (portless, host-only) #11

New issue
Open
opened 2026-07-29 09:41:58 +00:00 by james.oates · 0 comments
james.oates commented 2026-07-29 09:41:58 +00:00
Owner
Copy link

Target state agreed 2026-07-29: host clients reach devinfra's OpenBao as https://bao.dev.oates.ws (portless) via edge-router, replacing the current interim compose port mapping 127.0.0.1:8200 → openbao:443. Containers keep talking to OpenBao directly over devnet (https://bao.dev.oates.ws, network alias) — the edge hop is host convenience only.

Three capabilities needed before devinfra can flip over:

  1. Per-route IP allowlisting (already in development) — the bao.dev.oates.ws route must only accept connections originating from the host itself; nothing off-device.
  2. Real certificate per host — edge-router currently presents a self-signed cert. For this route (and ideally all *.dev.oates.ws admin routes) it must serve the Let's Encrypt wildcard for *.dev.oates.ws (lives at devinfra/config/openbao/local/lego/certificates/, renewed weekly by devinfra/scripts/renew-cert.sh — a reload/re-read on renewal is needed too), otherwise host clients lose the verified-chain property the direct mapping has today.
  3. HTTPS upstream support — OpenBao is TLS-only on devnet by design (an extra plaintext listener would be reachable by every devnet container, not just edge-router). Edge-router therefore needs to proxy to an https:// target for this route (verifying against the same wildcard, or system roots).

When these land: devinfra drops the 8200:443 port mapping and updates CLAUDE.md (the interim is documented there).

Target state agreed 2026-07-29: host clients reach devinfra's OpenBao as `https://bao.dev.oates.ws` (portless) **via edge-router**, replacing the current interim compose port mapping `127.0.0.1:8200 → openbao:443`. Containers keep talking to OpenBao directly over devnet (`https://bao.dev.oates.ws`, network alias) — the edge hop is host convenience only. Three capabilities needed before devinfra can flip over: 1. **Per-route IP allowlisting** (already in development) — the `bao.dev.oates.ws` route must only accept connections originating from the host itself; nothing off-device. 2. **Real certificate per host** — edge-router currently presents a self-signed cert. For this route (and ideally all `*.dev.oates.ws` admin routes) it must serve the Let's Encrypt wildcard for `*.dev.oates.ws` (lives at `devinfra/config/openbao/local/lego/certificates/`, renewed weekly by `devinfra/scripts/renew-cert.sh` — a reload/re-read on renewal is needed too), otherwise host clients lose the verified-chain property the direct mapping has today. 3. **HTTPS upstream support** — OpenBao is TLS-only on devnet by design (an extra plaintext listener would be reachable by every devnet container, not just edge-router). Edge-router therefore needs to proxy to an `https://` target for this route (verifying against the same wildcard, or system roots). When these land: devinfra drops the `8200:443` port mapping and updates CLAUDE.md (the interim is documented there).
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
feat/openbao-transit-broker
v1.0.6
v1.0.5
v1.0.4
v1.0.3
v1.0.2
v1.0.1
v1.0.0
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
IsoHex/edge-router#11
No description provided.