chore: start modeling gymburgdorf demo and test bao secret lookup

Signed-off-by: Bert-Jan Fikse <bert-jan@whatwedo.ch>

Makefile

@@ -1,6 +1,12 @@
+export BAO_ADDR=https://bao.digitalboard.ch
+
 install:
 	ansible-galaxy collection install -r requirements.yml -p collections
 
+bao:
+	bao login -method=oidc -path=Digitalboard role=default
+	$(eval export VAULT_TOKEN=$(shell bao print token))
+
 ping_demo:
 	echo "# pinging demo-gymburgdorf"
 	ansible all -i inventories/demo-gymburgdorf/hosts.yml -m ping || true

README.md

@@ -4,14 +4,11 @@
 
 ### Secrets
 Secrets are managed using [OpenBao](https://bao.digitalboard.ch).
-Download the CLI binary once (not checked in):
+The bao CLI needs to be installed. e.g `sudo pacman -S openbao python-hvac`
-```bash
-curl -L https://github.com/openbao/openbao/releases/latest/download/bao_linux_amd64 -o ./bao && chmod +x ./bao
-```
 
 Authenticate and export token before running playbooks:
 ```bash
 export BAO_ADDR=https://bao.digitalboard.ch
-./bao login -method=oidc -path=Digitalboard
+bao login -method=oidc -path=Digitalboard
-export VAULT_TOKEN=$(./bao print token)
+export VAULT_TOKEN=$(bao print token)
 ``` 

inventories/demo-gymburgdorf/group_vars/all/docker.yml

@@ -0,0 +1 @@
+docker_registry_mirrors: ["https://registry-mirror.wksbern.ch"]

inventories/demo-gymburgdorf/group_vars/all/vault.yml

@@ -0,0 +1,2 @@
+vault_addr: "https://bao.digitalboard.ch"
+vault_mount: "demo-gymburgdorf"

inventories/demo-gymburgdorf/group_vars/backend_servers/traefik.yml

@@ -0,0 +1 @@
+traefik_mode: backend

inventories/demo-gymburgdorf/group_vars/traefik_servers/traefik.yml

@@ -0,0 +1,13 @@
+_acme_tsig: "{{ lookup('community.hashi_vault.hashi_vault', vault_mount + '/data/acme-tsig', url=vault_addr ) }}"
+
+traefik_use_ssl: true
+traefik_cert_mode: "acme"
+traefik_log_level: DEBUG
+traefik_network: proxy
+
+traefik_acme_dns_zone: "gymb._acme.digitalboard.ch"
+traefik_acme_dns_nameserver: "{{ _acme_tsig.server }}"
+traefik_acme_tsig_algorithm: "hmac-sha256"
+traefik_acme_tsig_key: "{{ _acme_tsig.tsig_key }}"
+traefik_acme_tsig_secret: "{{ _acme_tsig.tsig_secret }}"
+

inventories/demo-gymburgdorf/host_vars/reverseproxy/traefik.yml

@@ -0,0 +1 @@
+traefik_mode: dmz

inventories/demo-gymburgdorf/hosts.yml

@@ -22,6 +22,7 @@ all:
     backend_servers:
       hosts:
         application:
+        storage:
 
     garage_servers:
       hosts: