A script that takes vault backup from integrated storage automatically at 12:55 AM every day.

vault-backup.sh

#!/bin/bash

# https://chatgpt.com/share/67783615-a5c0-8000-87b3-6a9a9521523f

# Directory to store the backup
BACKUP_DIR="/path/to/backup"

# Vault credentials
VAULT_ADDR="http://127.0.0.1:8200"
VAULT_USER="maintenance"
VAULT_PASS="backup-password"

# Login and get the token
TOKEN=$(curl --silent --request POST --data '{"password": "'"$VAULT_PASS"'"}' \
  "$VAULT_ADDR/v1/auth/userpass/login/$VAULT_USER" | jq -r '.auth.client_token')

if [ -z "$TOKEN" ] || [ "$TOKEN" == "null" ]; then
  echo "Error: Failed to obtain Vault token"
  exit 1
fi

# Export the token for the snapshot command
export VAULT_TOKEN="$TOKEN"

# Create a new snapshot
SNAPSHOT_FILE="$BACKUP_DIR/vault-snapshot-$(date +%F-%H-%M).snap"
vault operator raft snapshot save "$SNAPSHOT_FILE"

# Retain only the latest backup (delete older ones)
ls -tp "$BACKUP_DIR"/vault-snapshot-*.snap | tail -n +2 | xargs -I {} rm -- {}

echo "Vault backup created: $SNAPSHOT_FILE"