https://alwaldend.com/docs/infra/vault/openspec/specs/infra-vault/ Recent content in Infra vault on Alwaldend Hugo en https://alwaldend.com/docs/infra/vault/openspec/specs/infra-vault/spec/ Mon, 01 Jan 0001 00:00:00 +0000 https://alwaldend.com/docs/infra/vault/openspec/specs/infra-vault/spec/ <span id="infrastructure-vault"></span><h2 id="purpose">Purpose<a class="td-heading-self-link" href="#purpose" aria-label="Heading self-link"></a></h2><p>Describe the Vault host configuration, authentication and certificate services, and packaged recovery entry points. This baseline concerns checked-in desired state and supported wrapper structure; it does not establish live unsealed state, successful backups, quorum, or certificate freshness.</p> <p>Baseline source revision: <code>550d7e79b1f5fdbc2b6017b75178471d6914082f</code>. Observation date: 2026-09-08. Sources are linked in full; no excerpts are used.</p> <p>Sources: <a href="https://alwaldend.com/docs/infra/vault/">operator documentation</a>, <a href="../../../BUILD.bazel">operational wrappers</a>, <a href="../../../ansible/BUILD.bazel">Ansible entry points</a>, <a href="../../../ansible/files/vault.hcl">Vault host template</a>, <a href="../../../tf/auth.tf">authentication backends</a>, <a href="../../../tf/mounts.tf">storage engines</a>, <a href="../../../tf/pki_servers.tf">server PKI</a>, <a href="../../../tf/pki_clients.tf">client PKI</a>, and <a href="../../../tf/outputs.tf">public CA outputs</a>.</p> <h2 id="requirements">Requirements<a class="td-heading-self-link" href="#requirements" aria-label="Heading self-link"></a></h2><h3 id="requirement-separate-host-provisioning-from-vault-configuration">Requirement: Separate host provisioning from Vault configuration<a class="td-heading-self-link" href="#requirement-separate-host-provisioning-from-vault-configuration" aria-label="Heading self-link"></a></h3><p>The documented workflow SHALL separate <code>tf_setup</code> VM provisioning, Ansible host setup, and the <code>tf</code> Vault configuration stage. Ansible SHALL expose combined, VM-only, and bare-metal-only setup entry points using the shared host and Vault roles.</p>