openbao: more noodling

Signed-off-by: oppiliappan <[e-mail]>

hosts/nixery/services/openbao/proxy.nix

···
 
       # Security hardening
       NoNewPrivileges = true;
-      PrivateTmp = true;
-      ProtectSystem = "strict";
-      ProtectHome = true;
-      ReadWritePaths = [ "/var/lib/openbao" "/var/log/openbao" ];
+      LogsDirectory = "openbao";
+      StateDirectory = "openbao";
 
       # Set proper environment
       Environment = [
         "VAULT_SKIP_VERIFY=true"
         "BAO_SKIP_VERIFY=true"
         "BAO_ADDR=http://127.0.0.1:8201"
-        "HOME=/var/lib/openbao"
       ];
     };
   };
···
   # Create necessary directories and files
   systemd.tmpfiles.rules = [
     # Directories
-    "d /var/lib/openbao 0755 openbao openbao -"
-    "d /var/lib/private/openbao 0755 openbao openbao -"
     "d /var/lib/openbao/cache 0755 openbao openbao -"
-    "d /var/log/openbao 0755 openbao openbao -"
     "d /etc/openbao 0755 root root -"
+    "f /var/lib/openbao/token 0640 openbao openbao -"
 
     # Credential files (content must be populated externally)
     "f /etc/openbao/role-id 0600 openbao openbao -"
···
 
     # Configuration file
     "f /etc/openbao/proxy.hcl 0644 root root -"
+    "f /var/lib/private/openbao/.bao 0644 openbao openbao -"
   ];
 }