This is a puppet module to install Hashicorp's vault project to keep your secrets safe. This module doesn't build the Vault packages which should be pretty easy to do using fpm.
Documentation for Vault can be found on their site. Take into consideration:
- You can only define one storage backend, listener and telemetry on the config file.
- Other configurations should be set up using Vault API or CLI.
include ::vault
This module enables you to use hiera to configure your Vault server. It also allows you to use module data.
vault::config_hash:
backend:
consul:
address: '127.0.0.1:8500'
advertise_addr: "http://%{::ipaddress_eth0}"
path: 'vault/'
listener:
tcp:
address: "%{::fqdn}:8200"
tls_disable: 1
telemetry:
statsite_address: '127.0.0.1:8125'
disable_hostname: true
disable_mlock: true
vault::manage_user: true
vault::package_ensure: 'latest'
vault::vault_user: 'vault'
vault::restart_cmd: '/etc/init.d/vault restart'
Ensure the following hiera key is present so Vault can be correctly uninstalled
vault::package_ensure: absent