{"id":5070,"date":"2025-07-10T08:39:47","date_gmt":"2025-07-10T12:39:47","guid":{"rendered":"https:\/\/dft.wiki\/?p=5070"},"modified":"2026-06-08T09:24:14","modified_gmt":"2026-06-08T13:24:14","slug":"deploy-a-key-vault-to-store-secrets","status":"publish","type":"post","link":"https:\/\/dft.wiki\/?p=5070","title":{"rendered":"Deploy a Key Vault to store Secrets"},"content":{"rendered":"

Hashicorp Vault<\/strong> is an open-source tool for storing and controlling access to secrets, such as tokens, passwords, certificates, encryption keys, and other sensitive data. It can be accessed manually through a UI, programmatically using the CLI, or via the HTTP API [Link<\/a>].<\/p>\n

With Vault<\/strong>, specific actions (e.g., read, create, update, delete) can be granted on specific secrets, enabling full separation of duties for a defined duration (auto-expire) or a designated call source.<\/p>\n

\n

INSTALLING VAULT<\/strong><\/p>\n

Using Snap on Ubuntu\/Debian:<\/p>\n

sudo apt install snapd -y\r\nsudo snap install vault<\/pre>\n
Alternatively, add the official repository to the system’s package manager.<\/p>\n
wget -O - https:\/\/apt.releases.hashicorp.com\/gpg | sudo gpg --dearmor -o \/usr\/share\/keyrings\/hashicorp-archive-keyring.gpg\r\necho \"deb [arch=$(dpkg --print-architecture) signed-by=\/usr\/share\/keyrings\/hashicorp-archive-keyring.gpg] https:\/\/apt.releases.hashicorp.com $(grep -oP '(?<=UBUNTU_CODENAME=).*' \/etc\/os-release || lsb_release -cs) main\" | sudo tee \/etc\/apt\/sources.list.d\/hashicorp.list\r\nsudo apt update && sudo apt install vault -y<\/pre>\n
See more installation methods at [Link<\/a>].<\/p>\n
Edit the configuration file:<\/p>\n
sudo nano \/etc\/vault.d\/vault.hcl<\/pre>\n
ui = true\r\ndisable_mlock = true\r\ndefault_lease_ttl =\"87600\"\r\nmax_lease_ttl = \"87600\"\r\nstorage \"file\" {\r\n  path = \"\/opt\/vault\/data\"\r\n}\r\n\r\n# HTTP listener\r\nlistener \"tcp\" {\r\n  address = \"127.0.0.1:8200\"\r\n  tls_disable = 1\r\n}<\/pre>\n
systemctl enable vault --now\r\nexport VAULT_ADDR=http:\/\/127.0.0.1:8200\r\nvault status<\/pre>\n
\"\"<\/p>\n
Note:<\/strong> Vault is not yet initialized and is currently sealed.<\/p>\n
Navigate to http:\/\/127.0.0.1:8200<\/strong>, or create an SSH tunnel as follows.<\/p>\n
\n
INITIALIZE AND UNSEAL THE VAULT<\/strong><\/p>\n
ssh root@192.168.1.200<\/strong> -L 8200:localhost:8200<\/pre>\n
Vault can be initialized via the Web UI<\/strong>:<\/p>\n
\"\"<\/p>\n
Or via the CLI<\/strong>:<\/p>\n
export VAULT_ADDR=http:\/\/127.0.0.1:8200\r\nvault operator init<\/pre>\n
OR<\/strong><\/p>\n
vault operator init -key-shares=5 -key-threshold=3 > keys.json<\/pre>\n
\"\"<\/p>\n
Now unseal the Vault:<\/p>\n
vault operator unseal<\/pre>\n
Provide the Unseal Keys<\/strong> from the previous step.<\/p>\n
\"\"<\/p>\n
Vault is now ready to be accessed with the Initial Root Token<\/strong>.<\/p>\n
\"\"<\/p>\n
Log in with the Initial Root Token<\/strong>:<\/p>\n
vault login<\/pre>\n
Development (Unsafe) Deployment<\/strong><\/p>\n
In a development environment where reduced security is acceptable:<\/p>\n
export VAULT_ADDR=http:\/\/127.0.0.1:8200\r\nvault operator init -key-shares=1 -key-threshold=1 -format=json > init.json\r\nvault operator unseal $(jq -r '.unseal_keys_b64[0]' init.json)\r\nvault login $(jq -r '.root_token' init.json)<\/pre>\n
\n
MANAGING POLICIES AND TOKENS<\/strong><\/p>\n
Using the Initial Root Token<\/strong>, enable a KV secrets engine:<\/p>\n
export VAULT_ADDR=http:\/\/127.0.0.1:8200\r\nvault login\r\nvault secrets enable -path=kv kv<\/pre>\n
\"\"<\/p>\n
Create Policies<\/strong>:<\/p>\n
cat <<EOF > readonly-policy.hcl\r\npath \"kv\/*\" {\r\ncapabilities = [\"read\", \"list\"]\r\n}\r\nEOF\r\nvault policy write readonly readonly-policy.hcl<\/pre>\n
cat <<EOF > readwrite-policy.hcl\r\npath \"kv\/*\" {\r\ncapabilities = [\"create\", \"read\", \"update\", \"delete\", \"list\"]\r\n}\r\nEOF\r\nvault policy write readwrite readwrite-policy.hcl<\/pre>\n
Note:<\/strong> These policies are overly permissive and should be used for reference only.<\/p>\n
vault policy list<\/pre>\n
\"\"<\/p>\n
Create Tokens<\/strong> linked to policies:<\/p>\n
vault token create -policy=readonly<\/strong> -orphan -no-default-policy -ttl=0\r\nvault token create -policy=readwrite<\/strong> -orphan -no-default-policy -ttl=0<\/pre>\n
\"\"<\/p>\n
Note:<\/strong> These tokens are insecure and should be used for reference only. If needed, set the TTL to 87600 for a 10-year expiry.<\/p>\n
To check a token’s permissions and status:<\/p>\n
vault token lookup <TOKEN><\/pre>\n
\n
PUSHING AND PULLING SECRETS<\/strong><\/p>\n
Set the environment variables:<\/p>\n
export VAULT_ADDR='http:\/\/127.0.0.1:8200\/'\r\nexport VAULT_TOKEN=hvs.CAESIAH6vrn9oT0ITzzaCTSc4m9auVNuOULnpB8NqUsLdmv0Gh4KHGh2cy5wQVFpNzJodm1DcE5pRWNENFlBb21KWk4<\/strong><\/pre>\n
Test writing and reading a secret from another host:<\/p>\n
vault kv put kv\/example.com cert=test key=test root_ca=test\r\nvault kv get kv\/example.com<\/pre>\n
\"\"<\/p>\n
Write (create or update) a secret using Read+Write access:<\/p>\n
vault kv put kv\/example.com<\/strong> cert=@\/etc\/letsencrypt\/live\/example.com<\/strong>\/cert.pem key=@\/etc\/letsencrypt\/live\/example.com<\/strong>\/cert.pem root_ca=@\/etc\/letsencrypt\/live\/example.com<\/strong>\/fullchain.pem<\/pre>\n
Note:<\/strong> The @<\/code> symbol loads the file’s contents, not the path string.<\/p>\n
From another host, read the secret using Read-Only access:<\/p>\n
export VAULT_ADDR='http:\/\/127.0.0.1:8200\/'\r\nexport VAULT_TOKEN=hvs.CAESIDRbO6D1-LpgJrZK-bnM-J67C5SrUl7LR7hsmJhCdyNCGh4KHGh2cy50RU1oWmtub3VBNTUxZ3RkSWpOb2RhZWk\r\n<\/strong>vault kv get kv\/example.com\r\n<\/pre>\n
\"\"<\/p>\n
\n
ISSUING AN SSL\/TLS CERTIFICATE FOR VAULT<\/strong><\/p>\n
Before exposing Vault outside of localhost, secure it with a TLS certificate.<\/p>\n
sudo apt update\r\nsudo apt install certbot python3-certbot-nginx -y\r\nsudo nano \/etc\/nginx\/sites-available\/default<\/pre>\n
Set the server name to your public domain. It must be reachable on port 80 from the internet with no restrictions, as Let’s Encrypt will send HTTP requests from multiple random sources for the challenge.<\/p>\n
    server_name vault.example.com<\/strong>;<\/pre>\n
Test and apply the configuration:<\/p>\n
sudo nginx -t && sudo nginx -s reload<\/pre>\n
Run certbot<\/code> and follow the prompts to enter your email, accept the terms, and so on.<\/p>\n
echo 127.0.0.1 vault.example.com<\/strong> | sudo tee -a \/etc\/hosts\r\nsudo certbot --nginx<\/pre>\n
Confirm that automatic renewal is configured in systemd:<\/p>\n
sudo systemctl list-timers | grep certbot<\/pre>\n
If needed, place scripts in the following directories to run at specific points during renewal:<\/p>\n