We use this piece of software to let OpenBao register a new OIDC method
for login which will be used by machines.

Signed-off-by: Raito Bezarius <raito@afnix.fr>

@@ -0,0 +101,4 @@
+      example = [ "ovh-sbg-hv01-sts-jwt" "ovh-lim-hv01-sts-jwt" ];
+      description = "What is the authentication path for the JWT method?";
+    };
+    baoRole = mkOption {

@@ -0,0 +96,4 @@
+      default = "https://vault.afnix.fr";
+      description = "Address to the OpenBao instance";
+    };
+    baoAuthPath = mkOption {

@@ -0,0 +91,4 @@
+        Where secrets are created.
+      '';
+    };
+    baoAddress = mkOption {

@@ -0,0 +108,4 @@
+    };
+    secrets = mkOption {
+      type = types.attrsOf secretType;
+      default = { };

@@ -0,0 +11,4 @@
+{ lib, config, ... }:
+let
+  inherit (lib) mkIf concatMapAttrs nameValuePair listToAttrs;
+  trustDomain = config.networking.fqdn;

@@ -0,0 +23,4 @@
+      # NOTE(Raito): it's absolutely crucial this keeps being synchronized
+      # with Vault policies and their naming scheme.
+      # Any divergence will surface as failure to obtain a JWT-SVID.
+      spiffeID = "spiffe://${trustDomain}/tenants/${tenant}/svc/${svc}";

@@ -108,11 +107,21 @@ in
           ${concatStringsSep "\n" (mapAttrsToList (name: upstream: "${name} ${upstream};") cfg.redirects)}
         }
 
+        log_format basic '$remote_addr [$time_local] '

@@ -48,0 +48,4 @@
+          test = {
+            policy = {
+              "secret/data/afnix/test/*".capabilities = [
+                "create" "update" "read" "delete" "list"

@@ -42,0 +51,4 @@
+  # We want to verify that we can load test secrets.
+  baonix = {
+    audience = "afnix";
+    baoAuthPath = "jwt-ovh-sbg-hv01-sts-jwt";

@@ -41,1 +50,4 @@
 
+  # We want to verify that we can load test secrets.
+  baonix = {
+    audience = "afnix";

@@ -108,11 +107,21 @@ in
           ${concatStringsSep "\n" (mapAttrsToList (name: upstream: "${name} ${upstream};") cfg.redirects)}
         }
 
+        log_format basic '$remote_addr [$time_local] '