Onboard Boundary to CRT (#1786)

Onboard Boundary to Common Release Tooling

Co-authored-by: mdrake <mdrake@hashicorp.com>
Co-authored-by: jeanneryan <jeanneryan@hashicorp.com>

.release/linux/package/etc/boundary.d/boundary.hcl

@@ -0,0 +1,3 @@
+# # Full configuration options can be found at https://www.boundaryproject.io/docs/configuration
+
+# disable_mlock = true

.release/linux/package/etc/boundary.d/controller.hcl

@@ -0,0 +1,71 @@
+# # Note that this is an example systemd file and is not intended to be functional as-is.
+# # Full configuration options can be found at https://www.boundaryproject.io/docs/configuration/controller
+
+# # Disable memory lock: https://www.man7.org/linux/man-pages/man2/mlock.2.html
+# # disable_mlock = true
+
+# # Controller configuration block
+# controller {
+#   # This name attr must be unique across all controller instances if running in HA mode
+#   name = "demo-controller-1"
+#   description = "A controller for a demo!"
+
+#   # Database URL for postgres. This can be a direct "postgres://"
+#   # URL, or it can be "file://" to read the contents of a file to
+#   # supply the url, or "env://" to name an environment variable
+#   # that contains the URL.
+#   database {
+#       url = "postgresql://boundary:boundarydemo@postgres.yourdomain.com:5432/boundary"
+#   }
+# }
+
+# # API listener configuration block
+# listener "tcp" {
+#   # Should be the address of the NIC that the controller server will be reached on
+#   address = "10.0.0.1"
+#   # The purpose of this listener block
+#   purpose = "api"
+
+#   tls_disable = false
+
+#   # Uncomment to enable CORS for the Admin UI. Be sure to set the allowed origin(s)
+#   # to appropriate values.
+#   #cors_enabled = true
+#   #cors_allowed_origins = ["https://yourcorp.yourdomain.com", "serve://boundary"]
+# }
+
+# # Data-plane listener configuration block (used for worker coordination)
+# listener "tcp" {
+#   # Should be the IP of the NIC that the worker will connect on
+#   address = "10.0.0.1"
+#   # The purpose of this listener
+#   purpose = "cluster"
+# }
+
+# # Root KMS configuration block: this is the root key for Boundary
+# # Use a production KMS such as AWS KMS in production installs
+# kms "aead" {
+#   purpose = "root"
+#   aead_type = "aes-gcm"
+#   key = "sP1fnF5Xz85RrXyELHFeZg9Ad2qt4Z4bgNHVGtD6ung="
+#   key_id = "global_root"
+# }
+
+# # Worker authorization KMS
+# # Use a production KMS such as AWS KMS for production installs
+# # This key is the same key used in the worker configuration
+# kms "aead" {
+#   purpose = "worker-auth"
+#   aead_type = "aes-gcm"
+#   key = "8fZBjCUfN0TzjEGLQldGY4+iE9AkOvCfjh7+p0GtRBQ="
+#   key_id = "global_worker-auth"
+# }
+
+# # Recovery KMS block: configures the recovery key for Boundary
+# # Use a production KMS such as AWS KMS for production installs
+# kms "aead" {
+#   purpose = "recovery"
+#   aead_type = "aes-gcm"
+#   key = "8fZBjCUfN0TzjEGLQldGY4+iE9AkOvCfjh7+p0GtRBQ="
+#   key_id = "global_recovery"
+# }

.release/linux/package/etc/boundary.d/worker.hcl

@@ -0,0 +1,36 @@
+# # Note that this is an example systemd file and is not intended to be functional as-is.
+# # Full configuration options can be found at https://www.boundaryproject.io/docs/configuration/worker
+
+# listener "tcp" {
+#     purpose = "proxy"
+#     tls_disable = true
+#     address = "127.0.0.1"
+# }
+
+# worker {
+#   # Name attr must be unique across workers
+#   name = "demo-worker-1"
+#   description = "A default worker created demonstration"
+
+#   # Workers must be able to reach controllers on :9201
+#   controllers = [
+#     "10.0.0.1",
+#     "10.0.0.2",
+#     "10.0.0.3",
+#   ]
+
+#   public_addr = "myhost.mycompany.com"
+
+#   tags {
+#     type   = ["prod", "webservers"]
+#     region = ["us-east-1"]
+#   }
+# }
+
+# # must be same key as used on controller config
+# kms "aead" {
+#     purpose = "worker-auth"
+#     aead_type = "aes-gcm"
+#     key = "8fZBjCUfN0TzjEGLQldGY4+iE9AkOvCfjh7+p0GtRBQ="
+#     key_id = "global_worker-auth"
+# }

.release/linux/package/usr/lib/systemd/system/boundary.service

@@ -0,0 +1,23 @@
+[Unit]
+Description="HashiCorp Boundary - Identity-based access management for dynamic infrastructure"
+Documentation=https://www.boundaryproject.io/docs
+StartLimitIntervalSec=60
+StartLimitBurst=3
+
+[Service]
+EnvironmentFile=-/etc/boundary.d/boundary.env
+User=boundary
+Group=boundary
+ProtectSystem=full
+ProtectHome=read-only
+ExecStart=/usr/bin/boundary server -config=/etc/boundary.d/%i.hcl
+ExecReload=/bin/kill --signal HUP $MAINPID
+KillMode=process
+KillSignal=SIGINT
+Restart=on-failure
+RestartSec=5
+TimeoutStopSec=30
+LimitMEMLOCK=infinity
+
+[Install]
+WantedBy=multi-user.target

.release/linux/postrm

@@ -0,0 +1,8 @@
+#!/bin/bash
+
+if [ "$1" = "purge" ]
+then
+  userdel boundary
+fi
+
+exit 0

.release/linux/preinst

@@ -0,0 +1,13 @@
+#!/bin/bash
+
+set -eu
+
+USER="boundary"
+
+if ! id -u $USER > /dev/null 2>&1; then
+	useradd \
+		--system \
+		--user-group \
+		--shell /bin/false \
+		$USER
+fi