Page MenuHomeDevCentral
Files F11709352

No OneTemporary
Actions

View Options

diff --git a/roles/shellserver/vault/config.sls b/roles/shellserver/vault/config.sls
new file mode 100644
index 0000000..c7c7755
--- /dev/null
+++ b/roles/shellserver/vault/config.sls
@@ -0,0 +1,45 @@
+# -------------------------------------------------------------
+# Salt — Shell server's units
+# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+# Project: Eglide
+# License: Trivial work, not eligible to copyright
+# -------------------------------------------------------------
+
+{% from "map.jinja" import dirs, services with context %}
+
+# -------------------------------------------------------------
+# Vault server configuration
+# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+{{ dirs.etc }}/vault.d:
+ file.absent
+
+{{ dirs.etc }}/vault.hcl:
+ file.managed:
+ - source: salt://roles/shellserver/vault/files/vault.hcl
+ - mode: 644
+ - template: jinja
+ - context:
+ certificates_dir: {{ dirs.etc }}/certificates/vault
+ id: {{ grains['id'] }}
+
+# -------------------------------------------------------------
+# Vault directories
+# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+/var/db/vault:
+ file.directory:
+ - user: vault
+ - group: vault
+ - mode: 700
+ - makedirs: True
+
+# -------------------------------------------------------------
+# Service
+# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+
+{% if services['manager'] == 'systemd' %}
+/lib/systemd/system/vault.service:
+ file.managed:
+ - source: salt://roles/shellserver/vault/files/vault.service
+{% endif %}
diff --git a/roles/shellserver/vault/files/vault.hcl b/roles/shellserver/vault/files/vault.hcl
new file mode 100644
index 0000000..0425c34
--- /dev/null
+++ b/roles/shellserver/vault/files/vault.hcl
@@ -0,0 +1,33 @@
+# -------------------------------------------------------------
+# Vault configuration
+# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
+# Project: Nasqueron
+# License: Trivial work, not eligible to copyright
+# Source file: roles/shellserver/vault/files/vault.hcl
+# -------------------------------------------------------------
+#
+# <auto-generated>
+# This file is managed by our rOPS SaltStack repository.
+#
+# Changes to this file may cause incorrect behavior
+# and will be lost if the state is redeployed.
+# </auto-generated>
+
+
+listener "tcp" {
+ address = "127.0.0.1:8200"
+
+ tls_cert_file = "{{ certificates_dir }}/fullchain.pem"
+ tls_key_file = "{{ certificates_dir }}/private.key"
+}
+
+storage "raft" {
+ path = "/var/db/vault"
+ node_id = "{{ id }}"
+}
+
+disable_mlock = true
+
+cluster_addr = "http://127.0.0.1:8201"
+api_addr = "http://127.0.0.1:8200"
+ui = true
diff --git a/roles/shellserver/vault/files/vault.service b/roles/shellserver/vault/files/vault.service
new file mode 100644
index 0000000..db0f1f2
--- /dev/null
+++ b/roles/shellserver/vault/files/vault.service
@@ -0,0 +1,33 @@
+[Unit]
+Description="HashiCorp Vault - A tool for managing secrets"
+Documentation=https://www.vaultproject.io/docs/
+Requires=network-online.target
+After=network-online.target
+ConditionFileNotEmpty=/etc/vault.hcl
+StartLimitIntervalSec=60
+StartLimitBurst=3
+
+[Service]
+Type=notify
+User=vault
+Group=vault
+ProtectSystem=full
+ProtectHome=read-only
+PrivateTmp=yes
+PrivateDevices=yes
+SecureBits=keep-caps
+AmbientCapabilities=CAP_IPC_LOCK
+CapabilityBoundingSet=CAP_SYSLOG CAP_IPC_LOCK
+NoNewPrivileges=yes
+ExecStart=/usr/bin/vault server -config /etc/vault.hcl
+ExecReload=/bin/kill --signal HUP $MAINPID
+KillMode=process
+KillSignal=SIGINT
+Restart=on-failure
+RestartSec=5
+TimeoutStopSec=30
+LimitNOFILE=65536
+LimitMEMLOCK=infinity
+
+[Install]
+WantedBy=multi-user.target
diff --git a/roles/shellserver/vault/init.sls b/roles/shellserver/vault/init.sls
index 127524e..a653ce1 100644
--- a/roles/shellserver/vault/init.sls
+++ b/roles/shellserver/vault/init.sls
@@ -1,9 +1,10 @@
# -------------------------------------------------------------
# Salt — Shell server's units
# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
# Project: Eglide
# License: Trivial work, not eligible to copyright
# -------------------------------------------------------------
include:
- .software
+ - .config

File Metadata

Mime Type
text/x-diff
Expires
Mon, Sep 15, 09:34 (3 h, 45 m)
Storage Engine
blob
Storage Format
Raw Data
Storage Handle
2983986
Default Alt Text
(4 KB)

Event Timeline

Nasqueron DevCentral · If it had been much bigger the moon would have had a core of ice. · Powered by Phabricator