add seal stanza

Author: Nicolas Brieussel

platform/local/openbao.yml

@@ -19,6 +19,17 @@ spec:
             # enabled: true
           ha:
             enabled: false
+          # AWS credentials the awskms seal authenticates with. OpenBao must read
+          # these at startup to unseal — they cannot come from OpenBao itself
+          # (chicken-and-egg). Secret created out-of-band by 02-cluster/local
+          # terraform; values originate from 03-backup/scaleway kms.tf.
+          extraSecretEnvironmentVars:
+            - envName: AWS_ACCESS_KEY_ID
+              secretName: openbao-unseal-aws
+              secretKey: access_key
+            - envName: AWS_SECRET_ACCESS_KEY
+              secretName: openbao-unseal-aws
+              secretKey: secret_key
           standalone:
             config: |
               ui = true
@@ -30,6 +41,13 @@ spec:
                 path    = "/openbao/data"
                 node_id = "openbao-0"
               }
+              # Auto-unseal via AWS KMS. region + kms_key_id are non-secret
+              # (the IAM creds above gate access). On first `bao operator init`
+              # this yields RECOVERY keys, not unseal keys — store them safely.
+              seal "awskms" {
+                region     = "eu-west-3"
+                kms_key_id = "367e11de-75f4-4df0-a038-b6cf06ae2ead"
+              }
 
         snapshotAgent:
           enabled: true