vault: add dockerfile

4 files changed, 108 insertions, 0 deletions

diff --git a/vault/Dockerfile b/vault/Dockerfile
new file mode 100644
index 0000000..bf8f9e7
--- /dev/null
+++ b/vault/Dockerfile
@@ -0,0 +1,24 @@
+FROM alpine:latest
+LABEL maintainer="Mike Crute <mike@crute.us>"
+
+ARG vault_version
+
+RUN set -euxo pipefail; \
+    apk --no-cache add \
+        gettext \
+        openssl \
+    ; \
+    \
+    wget https://releases.hashicorp.com/vault/${vault_version}/vault_${vault_version}_linux_amd64.zip; \
+    unzip vault_${vault_version}_linux_amd64.zip; \
+    rm vault_${vault_version}_linux_amd64.zip; \
+    mv vault /usr/sbin/vault;
+
+# This breaks the executable for some reason
+#    setcap cap_ipc_lock=+ep /usr/sbin/vault;
+
+ADD vault.hcl /vault.hcl.tpl
+ADD entrypoint.sh /entrypoint.sh
+
+ENTRYPOINT [ "/entrypoint.sh" ]
+CMD [ "/usr/sbin/vault", "server", "-config=vault.hcl" ]
diff --git a/vault/Makefile b/vault/Makefile
new file mode 100644
index 0000000..fc633f6
--- /dev/null
+++ b/vault/Makefile
@@ -0,0 +1,23 @@
+VERSION=1.10.2
+IMAGE=docker.crute.me/vault:$(VERSION)
+LATEST=$(subst :$(VERSION),,$(IMAGE)):latest
+
+all:
+        docker build \
+                --no-cache \
+                --build-arg=vault_version=$(VERSION) \
+                -t $(IMAGE) .
+run:
+        docker run -ti \
+                -p 8200:8200 \
+                -p 8201:8201 \
+                -v ${PWD}/vault-data:/data \
+                -e VAULT_RAFT_NODE_ID="node1" \
+                -e CLUSTER_ADDRESS="172.16.0.191:8201" \
+                -e API_ADDRESS="172.16.0.191:8200" \
+                docker.crute.me/vault:latest
+
+publish:
+        docker push $(IMAGE)
+        docker tag $(IMAGE) $(LATEST)
+        docker push $(LATEST)
diff --git a/vault/entrypoint.sh b/vault/entrypoint.sh
new file mode 100755
index 0000000..52b2689
--- /dev/null
+++ b/vault/entrypoint.sh
@@ -0,0 +1,35 @@
+#!/bin/sh
+
+set -e
+
+if [ -z "$API_ADDRESS" ]; then
+        echo "Environment variable API_ADDRESS must be specified as addr:port"
+        exit 1
+fi
+
+if [ -z "$CLUSTER_ADDRESS" ]; then
+        echo "Environment variable CLUSTER_ADDRESS must be specified as addr:port"
+        exit 1
+fi
+
+if [ -z "$VAULT_RAFT_NODE_ID" ]; then
+        echo "Environment variable VAULT_RAFT_NODE_ID must be specified"
+        exit 1
+fi
+
+if [ -z "$ENTRYPOINT_VAULT_HOSTNAME" ]; then
+        echo "Environment variable ENTRYPOINT_VAULT_HOSTNAME must be specified"
+        exit 1
+fi
+
+#openssl req -x509 -nodes -days 3650 -newkey rsa:4096 \
+#       -keyout /private_key.pem -out /certificate.pem \
+#       -subj "/C=US/L=Seattle/O=Pomona Consulting LLC/CN=${ENTRYPOINT_VAULT_HOSTNAME}"
+
+envsubst < /vault.hcl.tpl > /vault.hcl
+
+# TODO: Fix SAN
+# TODO: Issuer has host CN
+# TODO: Subject can just be CN
+
+exec "$@"
diff --git a/vault/vault.hcl b/vault/vault.hcl
new file mode 100644
index 0000000..ac7d771
--- /dev/null
+++ b/vault/vault.hcl
@@ -0,0 +1,26 @@
+ui = true
+
+storage "raft" {
+    path = "/data"
+}
+
+listener "tcp" {
+    address = "[::]:8200"
+    cluster_address = "[::]:8201"
+
+    tls_cert_file = "/data/ssl/letsencrypt_vault_sea4_crute_me.pem"
+    tls_key_file = "/data/ssl/letsencrypt_vault_sea4_crute_me_key.pem"
+
+    telemetry {
+        unauthenticated_metrics_access = true
+    }
+}
+
+telemetry {
+    disable_hostname = true
+}
+
+disable_mlock = true
+
+api_addr = "https://${API_ADDRESS}"
+cluster_addr = "https://${CLUSTER_ADDRESS}"