Hashicorp Vault Secrets Server selbst hosten (Docker)

sudo mkdir /etc/vault
cd /etc/vault

sudo tee extfile.cnf << EOF
[ req ]
distinguished_name = req_distinguished_name
x509_extensions = v3_ca
prompt = no

[ req_distinguished_name ]
C = DE
ST = MyState
L = MyLocation
O = MyPlace
CN = RootCA

[ v3_ca ]
subjectKeyIdentifier = hash
authorityKeyIdentifier = keyid:always,issuer
basicConstraints = critical,CA:true
keyUsage = critical, digitalSignature, cRLSign, keyCertSign
EOF

sudo tee extfile01.cnf << EOF
[ req ]
distinguished_name = req_distinguished_name
req_extensions = req_ext
prompt = no

[ req_distinguished_name ]
C = DE
ST = MyState
L = MyLocation
O = MyPlace
CN = app01

[req_ext]
subjectAltName = @alt_names

[alt_names]
IP.1 = 192.168.100.111
IP.2 = 127.0.0.1
DNS.1 = app01
DNS.2 = vault
EOF

sudo tee extfile02.cnf << EOF
[ req ]
distinguished_name = req_distinguished_name
req_extensions = req_ext
prompt = no

[ req_distinguished_name ]
C = DE
ST = MyState
L = MyLocation
O = MyPlace
CN = app02

[req_ext]
subjectAltName = @alt_names

[alt_names]
IP.1 = 192.168.100.112
IP.2 = 127.0.0.1
DNS.1 = app02
DNS.2 = vault
EOF

sudo tee extfile03.cnf << EOF
[ req ]
distinguished_name = req_distinguished_name
req_extensions = req_ext
prompt = no

[ req_distinguished_name ]
C = DE
ST = MyState
L = MyLocation
O = MyPlace
CN = app03

[req_ext]
subjectAltName = @alt_names

[alt_names]
IP.1 = 192.168.100.113
IP.2 = 127.0.0.1
DNS.1 = app03
DNS.2 = vault
EOF

cd /etc/vault

# CA
sudo openssl genrsa -out ca.key 4096
sudo openssl req -new -x509 -days 3650 -key ca.key -out ca.crt -config extfile.cnf

# Host 01
sudo openssl genrsa -out vault01.key 4096
sudo openssl req -new -key rsa:4096 -key vault01.key -out vault01.csr -config extfile01.cnf
sudo openssl x509 -req -days 3650 -in vault01.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out vault01.crt -extensions req_ext -extfile extfile01.cnf

# Host 02
sudo openssl genrsa -out vault02.key 4096
sudo openssl req -new -key rsa:4096 -key vault02.key -out vault02.csr -config extfile02.cnf
sudo openssl x509 -req -days 3650 -in vault02.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out vault02.crt -extensions req_ext -extfile extfile02.cnf

# Host 03
sudo openssl genrsa -out vault03.key 4096
sudo openssl req -new -key rsa:4096 -key vault03.key -out vault03.csr -config extfile03.cnf
sudo openssl x509 -req -days 3650 -in vault03.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out vault03.crt -extensions req_ext -extfile extfile03.cnf

sudo ufw allow proto tcp from 192.168.100.0/24 to any port 8200
sudo ufw allow proto tcp from 192.168.100.0/24 to any port 8201

{
	"Version": "2012-10-17",
	"Statement": [
		{
			"Sid": "VaultKMSUnseal",
			"Effect": "Allow",
			"Action": [
				"kms:Decrypt",
				"kms:Encrypt",
				"kms:DescribeKey"
			],
			"Resource": "*"
		}
	]
}

access_key=123
secret_key=secret
kms_key_id=key
kms_region=eu-central-1

cd /etc/vault

# Config
sudo tee vault.hcl << EOF
cluster_addr  = "https://192.168.100.111:8201"
api_addr      = "https://0.0.0.0:8200"

storage "raft" {
  path = "/vault/data"
  
  retry_join {
    leader_api_addr = "https://app02:8200"
    leader_ca_cert_file = "/vault/config/ca.crt"
    leader_client_cert_file = "/vault/config/vault02.crt"
    leader_client_key_file = "/vault/config/vault02.key"
  }
  retry_join {
    leader_api_addr = "https://app03:8200"
    leader_ca_cert_file = "/vault/config/ca.crt"
    leader_client_cert_file = "/vault/config/vault03.crt"
    leader_client_key_file = "/vault/config/vault03.key"
  }
}
listener "tcp" {
  address = "0.0.0.0:8200"
  tls_cert_file = "/vault/config/vault01.crt"
  tls_key_file = "/vault/config/vault01.key"
}
seal "awskms" {
  region     = "${kms_region}"
  access_key = "${access_key}"
  secret_key = "${secret_key}"
  kms_key_id = "${kms_key_id}"
}
EOF

sudo chmod 600 vault.hcl

# Network
docker network create --driver=bridge --subnet=192.168.128.0/24 app

# Volumes
docker volume create vault
docker volume create vault_log

# Access
docker run --rm -v /etc/vault:/data:rw docker.io/hashicorp/vault chown vault:vault /data
docker run --rm -v vault:/data:rw docker.io/hashicorp/vault chown vault:vault /data
docker run --rm -v vault_log:/data:rw docker.io/hashicorp/vault chown vault:vault /data

# Service
docker run -d --restart unless-stopped --network=app --name vault --cap-add IPC_LOCK -p 192.168.100.111:8200:8200 \
   -p 192.168.100.111:8201:8201 --add-host app01:192.168.100.111 --add-host app02:192.168.100.112 \
   --add-host app03:192.168.100.113 -v /etc/vault:/vault/config:ro -v vault:/vault/data -v vault_log:/vault/logs \
   docker.io/hashicorp/vault server

access_key=123
secret_key=secret
kms_key_id=key
kms_region=eu-central-1

cd /etc/vault

sudo tee vault.hcl << EOF
cluster_addr  = "https://192.168.100.112:8201"
api_addr      = "https://0.0.0.0:8200"

storage "raft" {
  path = "/vault/data"
  
  retry_join {
    leader_api_addr = "https://app01:8200"
    leader_ca_cert_file = "/vault/config/ca.crt"
    leader_client_cert_file = "/vault/config/vault01.crt"
    leader_client_key_file = "/vault/config/vault01.key"
  }
  retry_join {
    leader_api_addr = "https://app03:8200"
    leader_ca_cert_file = "/vault/config/ca.crt"
    leader_client_cert_file = "/vault/config/vault03.crt"
    leader_client_key_file = "/vault/config/vault03.key"
  }
}
listener "tcp" {
  address = "0.0.0.0:8200"
  tls_cert_file = "/vault/config/vault02.crt"
  tls_key_file = "/vault/config/vault02.key"
}
seal "awskms" {
  region     = "${kms_region}"
  access_key = "${access_key}"
  secret_key = "${secret_key}"
  kms_key_id = "${kms_key_id}"
}
EOF

sudo chmod 600 vault.hcl

# Network
docker network create --driver=bridge --subnet=192.168.128.0/24 app

# Volumes
docker volume create vault
docker volume create vault_log

# Access
docker run --rm -v /etc/vault:/data:rw docker.io/hashicorp/vault chown vault:vault /data
docker run --rm -v vault:/data:rw docker.io/hashicorp/vault chown vault:vault /data
docker run --rm -v vault_log:/data:rw docker.io/hashicorp/vault chown vault:vault /data

# Service
docker run -d --restart unless-stopped --network=app --name vault --cap-add IPC_LOCK -p 192.168.100.112:8200:8200 \
  -p 192.168.100.112:8201:8201 --add-host app01:192.168.100.111 --add-host app02:192.168.100.112 \
  --add-host app03:192.168.100.113 -v /etc/vault:/vault/config:ro -v vault:/vault/data -v vault_log:/vault/logs \
  docker.io/hashicorp/vault server

access_key=123
secret_key=secret
kms_key_id=key
kms_region=eu-central-1

cd /etc/vault

sudo tee vault.hcl << EOF
cluster_addr  = "https://192.168.100.113:8201"
api_addr      = "https://0.0.0.0:8200"

storage "raft" {
  path = "/vault/data"
  
  retry_join {
    leader_api_addr = "https://app01:8200"
    leader_ca_cert_file = "/vault/config/ca.crt"
    leader_client_cert_file = "/vault/config/vault01.crt"
    leader_client_key_file = "/vault/config/vault01.key"
  }
  retry_join {
    leader_api_addr = "https://app02:8200"
    leader_ca_cert_file = "/vault/config/ca.crt"
    leader_client_cert_file = "/vault/config/vault02.crt"
    leader_client_key_file = "/vault/config/vault02.key"
  }
}
listener "tcp" {
  address = "0.0.0.0:8200"
  tls_cert_file = "/vault/config/vault03.crt"
  tls_key_file = "/vault/config/vault03.key"
}
seal "awskms" {
  region     = "${kms_region}"
  access_key = "${access_key}"
  secret_key = "${secret_key}"
  kms_key_id = "${kms_key_id}"
}
EOF

sudo chmod 600 vault.hcl

# Network
docker network create --driver=bridge --subnet=192.168.128.0/24 app

# Volumes
docker volume create vault
docker volume create vault_log

# Access
docker run --rm -v /etc/vault:/data:rw docker.io/hashicorp/vault chown vault:vault /data
docker run --rm -v vault:/data:rw docker.io/hashicorp/vault chown vault:vault /data
docker run --rm -v vault_log:/data:rw docker.io/hashicorp/vault chown vault:vault /data

# Service
docker run -d --restart unless-stopped --network=app --name vault --cap-add IPC_LOCK -p 192.168.100.113:8200:8200 \
  -p 192.168.100.113:8201:8201 --add-host app01:192.168.100.111 --add-host app02:192.168.100.112 \
  --add-host app03:192.168.100.113 -v /etc/vault:/vault/config:ro -v vault:/vault/data -v vault_log:/vault/logs \
  docker.io/hashicorp/vault server

docker run --rm -ti --network=app -v /etc/vault:/vault/config:ro -e VAULT_ADDR=https://vault:8200 \
  -e VAULT_CACERT=/vault/config/ca.crt -P docker.io/hashicorp/vault ash

vault operator init

vault operator status

docker run --rm -ti --network=app -v /etc/vault:/vault/config:ro -e VAULT_ADDR=https://vault:8200 \
  -e VAULT_CACERT=/vault/config/ca.crt -P docker.io/hashicorp/vault ash

export VAULT_TOKEN=MyTOken

vault secrets enable -version=2 -path=app -description="Application secrets" kv

vault kv put -mount=app apiKey key=PaipCijvonEtdysilgEirlOwUbHahachdyazVopejEnerekBiOmukvauWigbimVi

vault auth enable approle

echo 'path "app/data/apiKey" {
  capabilities = ["read"]
}' | vault policy write myapp -

vault write auth/approle/role/myapp token_ttl=1h token_max_ttl=8h secret_id_ttl=0 token_policies="myapp"
# read data
vault read auth/approle/role/myapp/role-id
# create secret id
vault write -force auth/approle/role/myapp/secret-id

vault write auth/approle/login role_id="123" secret_id="456"

export VAULT_TOKEN=AppRoleToken

vault kv get -mount=app apiKey

// vault.go
package main

import (
	"cmp"
	"context"
	"fmt"
	vault "github.com/hashicorp/vault/api"
	"github.com/hashicorp/vault/api/auth/approle"
	"github.com/rs/zerolog/log"
	"os"
)

// VaultClient is the global vault client
var VaultClient *vault.Client

// InitVault initializes the vault client
func InitVault() {
	vaultAddress := cmp.Or(os.Getenv("VAULT_ADDR"), "https://vault:8200")
	vaultCAFile := cmp.Or(os.Getenv("VAULT_CACERT"), "/etc/vault/ca.crt")

	// define config
	config := vault.DefaultConfig() // modify for more granular configuration
	config.Address = vaultAddress
	if err := config.ConfigureTLS(&vault.TLSConfig{
		CAPath: vaultCAFile,
	}); err != nil {
		log.Fatal().Str("VAULT_ADDR", vaultAddress).Str("VAULT_CACERT", vaultCAFile).Err(err).Msg("Failed to configure Vault TLS")
	}

	// create client
	client, err := vault.NewClient(config)
	if err != nil {
		log.Fatal().Str("VAULT_ADDR", vaultAddress).Str("VAULT_CACERT", vaultCAFile).Err(err).Msg("Failed to create Vault client")
	}

	ctx, cancelContextFunc := context.WithCancel(context.Background())
	defer cancelContextFunc()

	// copy to global variable
	VaultClient = client

	// initial login
	authInfo, err := vaultLogin(ctx)
	if err != nil {
		log.Fatal().Str("VAULT_ADDR", vaultAddress).Str("VAULT_CACERT", vaultCAFile).Err(err).Msg("Failed to login to Vault")
	}
	// start the lease-renewal goroutine & wait for it to finish on exit
	go vaultStartRenewLeases(authInfo)

	// everything ok, log success
	log.Info().Str("VAULT_ADDR", vaultAddress).Msg("Vault successfully connected and initial token created.")
}

func vaultLogin(ctx context.Context) (*vault.Secret, error) {
	// Get environment variables for Vault
	vaultAppRoleId := os.Getenv("APPROLE_ROLE_ID")

	if vaultAppRoleId == "" {
		log.Fatal().Msg("Error: Vault App Role not set.")
	}

	// initial login with AppRole
	appRoleAuth, err := approle.NewAppRoleAuth(vaultAppRoleId, &approle.SecretID{
		FromEnv: "APPROLE_SECRET_ID",
	})
	// TODO: we might want to create ResponseWrapping somehow
	// ref: https://www.vaultproject.io/docs/concepts/response-wrapping
	// ref: https://learn.hashicorp.com/tutorials/vault/secure-introduction?in=vault/app-integration#trusted-orchestrator
	// ref: https://learn.hashicorp.com/tutorials/vault/approle-best-practices?in=vault/auth-methods#secretid-delivery-best-practices
	// and example in: https://github.com/hashicorp/hello-vault-go/blob/main/sample-app/vault.go
	if err != nil {
		return nil, err
	}

	return VaultClient.Auth().Login(ctx, appRoleAuth)
}

func vaultStartRenewLeases(authToken *vault.Secret) {
	ctx, cancelContextFunc := context.WithCancel(context.Background())
	defer cancelContextFunc()

	log.Info().Msg("Starting lease renewal service.")
	defer log.Info().Msg("Stopping lease renewal service.")

	currentAuthToken := authToken

	for {
		renewed, err := renewLeases(ctx, currentAuthToken)
		if err != nil {
			log.Fatal().Err(err).Msg("Failed to renew leases")
		}

		if renewed&exitRequested != 0 {
			return
		}

		if renewed&expiringAuthToken != 0 {
			log.Printf("auth token: can no longer be renewed; will log in again")

			authToken, err := vaultLogin(ctx)
			if err != nil {
				log.Fatal().Err(err).Msg("Failed to login to Vault")
			}

			currentAuthToken = authToken
		}
	}
}

// renewResult is a bitmask which could contain one or more of the values below
type renewResult uint8

const (
	renewError renewResult = 1 << iota
	exitRequested
	expiringAuthToken                // will be revoked soon
)

func renewLeases(ctx context.Context, authToken *vault.Secret) (renewResult, error) {
	log.Info().Msg("Starting lease renewal.")

	// auth token
	authTokenWatcher, err := VaultClient.NewLifetimeWatcher(&vault.LifetimeWatcherInput{
		Secret: authToken,
	})
	if err != nil {
		return renewError, fmt.Errorf("unable to initialize auth token lifetime watcher: %w", err)
	}

	go authTokenWatcher.Start()
	defer authTokenWatcher.Stop()

	// monitor events from all watchers
	for {
		select {
		case <-ctx.Done():
			return exitRequested, nil

		// DoneCh will return if renewal fails, or if the remaining lease
		// duration is under a built-in threshold and either renewing is not
		// extending it or renewing is disabled.  In both cases, the caller
		// should attempt a re-read of the secret. Clients should check the
		// return value of the channel to see if renewal was successful.
		case err := <-authTokenWatcher.DoneCh():
			// Leases created by a token get revoked when the token is revoked.
			return expiringAuthToken, err

		// RenewCh is a channel that receives a message when a successful
		// renewal takes place and includes metadata about the renewal.
		case info := <-authTokenWatcher.RenewCh():
			log.Printf("auth token: successfully renewed; remaining duration: %ds", info.Secret.Auth.LeaseDuration)

			//case info := <-databaseCredentialsWatcher.RenewCh():
			//	log.Printf("database credentials: successfully renewed; remaining lease duration: %ds", info.Secret.LeaseDuration)
			//}
		}
	}
}

// main.go
package main

import (
  "context"
  "fmt"
)

func main() {
  InitVault()

  secret, err := VaultClient.KVv2("app").Get(context.Background(), "apiKey")
  if err != nil {
    panic("Failed to get token key from Vault")
  }

  fmt.Printf("API-Key: %s\n", secret.Data["key"])
}