Limit OpenBao audit log storage

[sehkone]

Problem

The Compose-managed OpenBao writes its declarative file audit device to /openbao/audit/audit.log on the openbao-audit named volume. Neither OpenBao nor Compose currently rotates that file, so it grows without bound for the lifetime of an installation. The OpenBao container also has no explicit logging-driver limit, leaving its stdout/stderr retention dependent on the Docker daemon default.

OpenBao documents file_path=stdout as suitable for containers, while Docker's local logging driver provides bounded, automatically compressed rotation. Since bootroot is still under development, this change does not need to migrate or preserve an existing openbao-audit volume.

References:

• https://openbao.org/docs/audit/file/
• https://docs.docker.com/engine/logging/drivers/local/

Decision

Keep the declarative OpenBao audit device, but send it to stdout and let Docker own retention. Configure the OpenBao service explicitly with the local logging driver, max-size: "20m", max-file: "3", and compression enabled. This bounds the OpenBao container's combined audit and process output to three 20 MiB segments before compression.

Do not add a systemd timer, logrotate integration, sidecar, new image, or host-path dependency. Do not add compatibility handling for an existing openbao-audit volume.

Configuration

Expose the two retention dimensions on bootroot infra install and through matching environment variables:

• --openbao-log-max-size <SIZE> / OPENBAO_LOG_MAX_SIZE, default 20m. This is the maximum uncompressed size of each Docker log segment. Accept a positive integer followed by Docker's k, m, or g unit, case-insensitively.
• --openbao-log-max-files <COUNT> / OPENBAO_LOG_MAX_FILES, default 3. This is the number of log segments retained and must be a positive integer.

infra install must persist the resolved values, including defaults, into the Compose-directory .env and upsert them on a repeated install. This keeps later infra up, init, reinit, and direct Compose invocations on the same retention policy instead of depending on the invoking shell. The Compose files must also use ${OPENBAO_LOG_MAX_SIZE:-20m} and ${OPENBAO_LOG_MAX_FILES:-3} fallbacks so they remain safe when used directly without a bootroot-generated .env.

Compression remains enabled and is not configurable in this issue. Invalid values must fail before .env is changed or Docker is invoked.

Scope

• Change the canonical openbao/openbao.hcl audit device from /openbao/audit/audit.log to stdout.
• Make both the TLS and plaintext OpenBao configuration renderers in src/commands/init/steps/openbao_tls.rs emit the same stdout audit destination so init and later rewrites cannot restore the unbounded file path.
• Apply the explicit local logging configuration to the OpenBao service in both docker-compose.yml and docker-compose.deploy.yml.
• Add the two infra install options and environment-variable bindings above, validate them, and persist their resolved values through the existing owned-key .env update path.
• Remove the /openbao/audit mount and top-level openbao-audit volume declaration from both Compose files.
• Remove the audit-volume ownership wrapper. Preserve the image's standard docker-entrypoint.sh and add an explicit Compose command for server -config=/openbao/config/openbao.hcl; the image default command is development mode and must not become the production command accidentally.
• Update clean --openbao-only and reinit so their destructive-volume sets, plans, tests, and English/Korean messages refer only to the remaining OpenBao data volume.
• Update English and Korean CLI/operations documentation so it explains that audit records are available through docker compose logs openbao/docker logs, are retained by Docker's bounded local driver, and are not stored in a separate named volume.
• Update lifecycle assertions to verify the AppRole login response and KV read response in container logs rather than by reading a file inside the container.
• Remove or update every live source, test, script, and documentation reference that assumes openbao-audit or /openbao/audit/audit.log. Historical changelog entries and RFC text must remain historical unless they are used as current operational instructions.
• Add an Unreleased changelog entry describing the user-observable bounded retention and removal of the separate audit volume.

Acceptance criteria

• docker compose config succeeds for both Compose files and shows the OpenBao service using the local logging driver with max-size=20m, max-file=3, and compression enabled.
• An install with no overrides writes OPENBAO_LOG_MAX_SIZE=20m and OPENBAO_LOG_MAX_FILES=3 to .env; an install with --openbao-log-max-size 64m --openbao-log-max-files 5 writes and applies 64m and 5. The corresponding environment variables provide the same override behavior according to clap's normal argument precedence.
• A repeated install upserts both keys without duplicating them, and later Compose-driving commands continue to use the persisted values when no shell overrides are present.
• A zero, missing unit, unsupported size unit, zero file count, or non-numeric file count is rejected before .env or Docker is touched.
• The OpenBao container starts in server mode with /openbao/config/openbao.hcl; it does not fall back to the image's server -dev -dev-no-store-token default.
• bootroot init succeeds and still verifies that a file audit device is active.
• After an AppRole login and a KV v2 read, docker logs <instance>-openbao contains the corresponding audit response records.
• TLS-enabled and plaintext configuration paths both retain file_path = "stdout" after configuration regeneration and reload.
• Neither Compose file mounts or declares openbao-audit, and a clean installation creates no audit named volume.
• clean --openbao-only and reinit remove the OpenBao state volume without looking for, reporting, or requiring an audit volume.
• No periodic maintenance unit, log-rotation process, extra container, or additional install artifact is introduced.
• English and Korean operator documentation and messages remain consistent.

Test plan

• Add or update focused unit tests for the canonical/generated HCL, Compose configuration, cleanup volume set, reinit plan, and English/Korean message parity.
• Add CLI parsing, validation, default/override, .env creation, and idempotent-upsert tests for both retention settings.
• Run docker compose -f docker-compose.yml config and docker compose -f docker-compose.deploy.yml config with the required interpolation variables supplied.
• Run the local and remote lifecycle audit assertions against docker logs and confirm they still identify both an AppRole login response and a KV read response.
• Inspect the running container and confirm its log driver/options and server command match the acceptance criteria.
• Run cargo fmt -- --check, cargo clippy --all-targets -- -D warnings, cargo doc --no-deps --document-private-items with RUSTDOCFLAGS=-D warnings, cargo build --workspace, and cargo test --workspace.