HashiCorp Vault

# Navigate to your identity stack directory
cd ~/identity-stack

# Create directory structure for Vault
mkdir -p vault/config      # Configuration files
mkdir -p vault/data        # Persistent storage
mkdir -p vault/logs        # Log files
mkdir -p vault/policies    # HCL policy files

# Verify structure
tree vault/ 2>/dev/null || ls -la vault/

# Create the Vault configuration file
cat > ~/identity-stack/vault/config/vault-config.hcl << 'EOF'
# ============================================
# VAULT SERVER CONFIGURATION
# ============================================

# User interface settings
ui = true

# Listener configuration - how Vault accepts connections
listener "tcp" {
  address       = "0.0.0.0:8200"    # Listen on all interfaces
  tls_disable   = true              # Disable TLS (Traefik handles TLS)
}

# Storage backend - where secrets are stored
storage "file" {
  path = "/vault/data"
}

# API Address - how Vault identifies itself
api_addr = "http://127.0.0.1:8200"

# Cluster Address - for HA setups
cluster_addr = "http://127.0.0.1:8201"

# Disable memory lock (required for Docker)
disable_mlock = true

# Logging configuration
log_level = "info"
log_file  = "/vault/logs/vault.log"
EOF

# Verify the file was created
cat ~/identity-stack/vault/config/vault-config.hcl

# Create a separate compose file for Vault
cat > ~/identity-stack/docker-compose.vault.yml << 'EOF'
# ============================================
# HASHICORP VAULT - Secrets Management
# ============================================

version: "3.8"

services:
  vault:
    image: hashicorp/vault:1.15
    container_name: vault
    restart: unless-stopped
    cap_add:
      - IPC_LOCK                 # Required for memory locking
    environment:
      VAULT_ADDR: "http://127.0.0.1:8200"
      VAULT_API_ADDR: "http://127.0.0.1:8200"
    ports:
      - "8200:8200"              # Vault API/UI
    volumes:
      - ./vault/config:/vault/config:ro     # Configuration
      - ./vault/data:/vault/data            # Persistent data
      - ./vault/logs:/vault/logs            # Logs
      - ./vault/policies:/vault/policies:ro # Policies
    command: server -config=/vault/config/vault-config.hcl
    networks:
      - identity-network
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.vault.rule=Host(\`vault.yourdomain.com\`)"
      - "traefik.http.routers.vault.entrypoints=websecure"
      - "traefik.http.routers.vault.tls.certresolver=letsencrypt"
      - "traefik.http.services.vault.loadbalancer.server.port=8200"

networks:
  identity-network:
    external: true
EOF

# Replace yourdomain.com with your actual domain
sed -i 's/yourdomain.com/YOUR_ACTUAL_DOMAIN.com/g' \
    ~/identity-stack/docker-compose.vault.yml

# Verify the change
grep "Host" ~/identity-stack/docker-compose.vault.yml

cd ~/identity-stack

# Pull the Vault image
docker compose -f docker-compose.vault.yml pull

# Start Vault
docker compose -f docker-compose.vault.yml up -d

# Check container is running
docker compose -f docker-compose.vault.yml ps

# View initial logs
docker logs vault

# Initialize Vault with 1 key share (for lab simplicity)
# In production, use 5 key shares with threshold of 3
docker exec vault vault operator init -key-shares=1 -key-threshold=1

# ⚠️ CRITICAL: You will see output like this:
# Unseal Key 1: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
# Initial Root Token: hvs.xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
# 
# SAVE THESE VALUES IMMEDIATELY!

# Unseal Vault with your unseal key
docker exec vault vault operator unseal YOUR_UNSEAL_KEY_HERE

# Check Vault status
docker exec vault vault status

# Login to Vault CLI (you'll be prompted for token)
docker exec -it vault vault login

# When prompted, paste your Root Token
# You should see: "Success! You are now authenticated."

# Verify you're logged in
docker exec vault vault token lookup

# Enable KV secrets engine version 2 at path "secret/"
docker exec vault vault secrets enable -path=secret kv-v2

# Verify it's enabled
docker exec vault vault secrets list

# Create a test secret
docker exec vault vault kv put secret/test \
    password="mysecretpassword" \
    username="testuser" \
    api_key="sk-1234567890"

# Read the secret back
docker exec vault vault kv get secret/test

# Create admin policy file
cat > ~/identity-stack/vault/policies/admin-policy.hcl << 'EOF'
# ============================================
# ADMIN POLICY - Full access to secrets
# ============================================

# Full access to all secrets
path "secret/*" {
  capabilities = ["create", "read", "update", "delete", "list"]
}

# Manage auth methods
path "auth/*" {
  capabilities = ["create", "read", "update", "delete", "list"]
}

# Manage policies
path "sys/policies/*" {
  capabilities = ["create", "read", "update", "delete", "list"]
}

# Manage mounts (secrets engines)
path "sys/mounts/*" {
  capabilities = ["create", "read", "update", "delete", "list"]
}
EOF

# Load the policy into Vault
docker exec vault vault policy write admin /vault/policies/admin-policy.hcl

# Verify policy was created
docker exec vault vault policy read admin

# Create developer policy file
cat > ~/identity-stack/vault/policies/developer-policy.hcl << 'EOF'
# ============================================
# DEVELOPER POLICY - Read-only access to app secrets
# ============================================

# Read app secrets only
path "secret/data/apps/*" {
  capabilities = ["read", "list"]
}

path "secret/metadata/apps/*" {
  capabilities = ["list"]
}

# Read database credentials
path "database/creds/readonly" {
  capabilities = ["read"]
}
EOF

# Load the policy
docker exec vault vault policy write developer /vault/policies/developer-policy.hcl

# List all policies
docker exec vault vault policy list