[Question/Feature Request] Native separation of API and Web UI traffic?

[linux-op]

Hello OpenBao team,

I am currently designing my architecture and I am looking for a way to natively separate the API traffic (used to communicate with my scripts) from the Web UI traffic.

I have done a lot of research but couldn't find a built-in solution. I tried adding a second listener block in the configuration and setting ui = false specifically for it, but it doesn't work at all (the ui parameter seems to be strictly global).

Is there any native way to achieve this directly within OpenBao, without having to rely on an external reverse proxy to filter the /ui/ paths?

Thank you very much for your help, I am currently stuck on this part of my design!

# --- NODE 1 ---
ui = true
disable_mlock = true

storage "raft" {
  path    = "/var/lib/openbao/data"
  node_id = "node-1"

  # Rejoindre Node 2
  retry_join {
    leader_api_addr         = "https://10.0.220.232:8203"
    leader_ca_cert_file     = "/etc/openbao.d/tls/ca.crt"
    leader_client_cert_file = "/etc/openbao.d/tls/node1.crt"
    leader_client_key_file  = "/etc/openbao.d/tls/node1.key"
  }

  # Rejoindre Node 3
  retry_join {
    leader_api_addr         = "https://10.0.106.84:8203"
    leader_ca_cert_file     = "/etc/openbao.d/tls/ca.crt"
    leader_client_cert_file = "/etc/openbao.d/tls/node1.crt"
    leader_client_key_file  = "/etc/openbao.d/tls/node1.key"
  }
}

listener "tcp" {
  address         = "0.0.0.0:8200"
  cluster_address = "0.0.0.0:8201"
  tls_cert_file       = "/etc/openbao.d/tls/node1.crt"
  tls_key_file        = "/etc/openbao.d/tls/node1.key"
  tls_client_ca_file  = "/etc/openbao.d/tls/ca.crt"
  tls_min_version     = "tls13"
}

api_addr     = "https://10.0.120.99:8203"
cluster_addr = "https://10.0.120.99:8201"

[DrDaveD]

So are you saying that you want the ui to be available to some addresses but not others, while allowing the API to be accessible everywhere?

I have had a desire for that and haven't figured out how to do it without a reverse proxy.