tbeyer567

#!/bin/bash

set -eu

VAULT_VERSION="1.11.4+ent-1"
VAULT_BINARY_LOCATION=/home/user123/vault
VAULT_LICENSE_KEY="lskdjaflwekajlr3lwkrj23lja<UPDATE>"
USER="vault"
GROUP="vault"
#ALL CERTIFICATES SHOULD BE BASE64

tbeyer567

# Read system health check
path "sys/health" {
  capabilities = ["read", "sudo"]
}

# Read license
path "sys/license" {
  capabilities = ["read"]
}

tbeyer567

module "hcp-vault" {
  source         = "./hcp-vault"
  cloud_provider = "aws"
  tier           = "plus_medium"

  primary_cluster_hvn      = "hvn-us-west-2"
  primary_region           = "us-west-2"
  primary_cluster_hvn_cidr = var.primary_hvn_cidr
  primary_cluster_id       = "vault-us-west-2"

tbeyer567

terraform {
  required_providers {
    vault = ">=3.14.0"
  }
}

provider "vault" {}

resource "vault_namespace" "dev" {
  path = "dev"

tbeyer567

module "primary_us_vpc" {
  source  = "terraform-aws-modules/vpc/aws"
  version = "4.0.1"

  providers = {
    aws = aws.us-east-1
  }

  name            = "vault-us-east-1"
  cidr            = "10.64.0.0/22"

tbeyer567

module "vault_west" {
  source = "../"

  vpc_cidr = "172.31.1.0/24"
  vpc_name = "vault-west"

  providers = {
    aws = aws.us-west-2
  }
}

tbeyer567

# Manage auth methods broadly across Vault
path "auth/*"
{
  capabilities = ["create", "read", "update", "delete", "list", "sudo"]
}

# Create, update, and delete auth methods
path "sys/auth/*"
{
  capabilities = ["create", "update", "delete", "sudo"]

tbeyer567

# Read system health check
path "sys/health"
{
  capabilities = ["read", "sudo"]
}

# Create and manage ACL policies broadly across Vault

# List existing policies
path "sys/policies/acl"

tbeyer567

provider "aws" {
  region = var.region
}

resource "aws_vpc" "main" {
  cidr_block           = var.vpc_cidr_block
  enable_dns_hostnames = true

  tags = {
    Name = var.vpc_name

tbeyer567

image:
  name: vault

variables:
  VAULT_ADDR: https://sensible-crow.butters.rocks:8200/

read_secrets:
  script:
    - export VAULT_CACERT=/builds/tbeyer/right-flounder/ca.pem
    - export VAULT_TOKEN="$(vault write -field=token auth/jwt/login role=demo-service-staging jwt=$CI_JOB_JWT)"