slawekandClaude Sonnet 5
91f1abef8a
Add vault-tpm2-unseal.sh/.service to unseal Vault once after boot using the TPM-sealed key, and tpm-bootstrap-1password.sh to (re)seal that key from a 1Password secret reference. Document PCR policy selection, the Vault service, and the host-specific tpm2.env (gitignored, example in README) in README.md. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
15 lines
316 B
Desktop File
15 lines
316 B
Desktop File
[Unit]
|
|
Description=Unseal HashiCorp Vault using a TPM 2.0 sealed key
|
|
Documentation=file:/etc/vault.d/tpm2.env
|
|
Requires=vault.service
|
|
After=vault.service
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
RemainAfterExit=yes
|
|
EnvironmentFile=/etc/vault.d/tpm2.env
|
|
ExecStart=/usr/local/sbin/vault-tpm2-unseal.sh
|
|
|
|
[Install]
|
|
WantedBy=vault.service
|