Links
- Intermediate CA: https://developer.hashicorp.com/vault/tutorials/pki/pki-engine-external-ca
- ACME: https://developer.hashicorp.com/vault/docs/secrets/pki/acme
Deployment
bazel run //infra/vault/tf_setup:tf.apply # Create VMs (requires an active Vault host)
bazel run //infra/vault/ansible # Set up hosts (BM and VMs)
bazel run //infra/vault/tf:tf.apply # Configure vault
Backup
bazel run //infra/vault:backup
Unseal
With a working Vault:
bazel run //infra/vault:unseal
Without a working Vault:
bazel run //infra/vault:unseal_standalone
Fix quorum
bazel run //infra/vault/ansible:fix_quorum
Set up only VMs
bazel run //infra/vault/ansible:ansible.vm # Set up only VMs
Set up only bare metal
bazel run //infra/vault/ansible:ansible.bm # Set up only bare metal
Tf
Plan:
bazel run //infra/vault/tf:tf.plan
Apply:
bazel run //infra/vault/tf:tf.apply
Run terraform directly:
bazel run //infra/vault/tf:tf.direct -- -chdir="${PWD}" plan
Replace VMs
bazel run //infra/vault/tf:tf.apply -- -replace 'module.vm_ha["host2"].proxmox_vm_qemu.vm' -replace 'module.vm_ha["host3"].proxmox_vm_qemu.vm
Generate and import a user cilent certificate
username="username"
bazel run //infra/vault:gen_client_cert -- --user "${username}" --output_dir "${PWD}"
bazel run //tools/ykman -- piv certificates import 9A "${PWD}/${username}.pfx"
bazel run //tools/ykman -- piv keys import 9A "${PWD}/${username}.pfx"
Generate a host cilent certificate
bazel run //infra/vault:gen_client_cert -- --host some-host --output_dir "${HOME}/.al/client_cert"
Generate a user device cilent certificate
bazel run //infra/vault:gen_client_cert -- --host some-host --user username --output_dir "${HOME}/.al/client_cert"
Unseal
- Prepare encrypted unseal token
- Run and input the encrypted token:
bazel run //infra/vault:unseal
Root token
- Prepare encrypted unseal token
- Run and input the encrypted token:
bazel run //infra/vault:gen_root_token -- --pgp_key path_to_public_gpg_key_in_base64
Generate an EAB for ACME
bazel run //infra/vault -- write -f pki/ica_servers/roles/ica_servers_dc1_pve1/acme/new-eab
Sign a client ssh key
bazel run //:vault -- write ssh/clients/sign/admins ttl=30000000 public_key=@"${HOME}/.ssh/key"
Revoke all tokens
bazel run //infra/vault -- token revoke -mode=path auth
Vault certificates
Vault certificates (tls_cert_file, tls_key_file) should be updated manually
Read OIDC client info
bazel run //infra/vault -- read identity/oidc/client/src_infra_dc1_forgejo1_provider
Read all entity aliases
bazel run //infra/vault -- list -format json identity/entity-alias/id | jq ".[]" | xargs "-I{}" bazel run //infra/vault -- read "identity/entity-alias/id/{}"