We use this piece of software to let OpenBao register a new OIDC method
for login which will be used by machines.

Signed-off-by: Raito Bezarius <raito@afnix.fr>

@@ -55,1 +55,3 @@
-    bagel.baremetal.hypervisor.enable = lib.mkEnableOption "hypervisor role";
+    bagel.baremetal.hypervisor = {
+      enable = lib.mkEnableOption "hypervisor role";
+      secondaryIPv6 = lib.mkOption {

@@ -36,0 +27,4 @@
+      defaultPolicyFragment = {
+        "auth/token/*".capabilities = [ "create" "read" "update" "delete" "list" ];
+      };
+      # spiffe://$TD/tenants/$TENANT/svc/forgejo

@@ -36,0 +22,4 @@
+    # Each region has its own OIDC discovery server and is expected to operate
+    # independently.
+    machine-identity = {
+      # audience = $tenant_id OR https://vault.afnix.fr

@@ -83,2 +131,4 @@
         "transit/decrypt/terraform-backend-states-key".capabilities = [ "create" "update" ];
       };
+
+      machine_sts = {

@@ -0,0 +7,4 @@
+  regionOpts = { config, ... }: {
+    options = {
+      trustDomain = mkOption {
+        type = types.str;

@@ -0,0 +12,4 @@
+
+      discoveryUrl = mkOption {
+        type = types.str;
+        default = "https://sts-oidc.${config.trustDomain}";

@@ -0,0 +1,126 @@
+# SPDX-FileCopyrightText: 2025 Tom Hubrecht <tom.hubrecht@dgnum.eu>
+#
+# SPDX-License-Identifier: EUPL-1.2

@@ -0,0 +89,4 @@
+          inherit (cfg.localTermination) port;
+          addr = "127.0.0.1";
+          ssl = true;
+          # proxyProtocol = true;