Tim Beyer tbeyer567
tbeyer567
/ su-policy.hcl
Created
March 30, 2022 17:28
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| path "*" { | |
| capabilities = ["create", "read", "update", "delete", "list", "sudo"] | |
| } |
tbeyer567
/ vault logrotate
Created
April 5, 2022 18:20
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| /var/log/vault/audit.json { | |
| rotate 7 | |
| daily | |
| compress | |
| delaycompress | |
| missingok | |
| notifempty | |
| extension json | |
| dateext | |
| dateformat %Y-%m-%d. |
tbeyer567
/ agent-policy.hcl
Created
May 16, 2022 15:10
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| path "auth/approle/role/agent/role-id" { | |
| capabilities=["read"] | |
| } | |
| path "auth/approle/role/agent/secret-id" { | |
| capabilities=["read","update"] | |
| } | |
| path "kv/data/application/db01" { | |
| capabilities=["read"] |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| [ca] | |
| default_ca = CA_default | |
| [ CA_default ] | |
| # Directory and file locations. | |
| dir = . | |
| certs = $dir/certs | |
| crl_dir = $dir/crl | |
| new_certs_dir = $dir/newcerts | |
| database = $dir/index.txt |
tbeyer567
/ gist:3a5fb9e1916c4afb0cb4fb8aba17dad8
Created
June 22, 2022 22:10
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| def secrets = [ | |
| [path: 'secret/jenkins/github', engineVersion: 2, secretValues: [ | |
| [envVar: 'PRIVATE_TOKEN', vaultKey: 'private-token'], | |
| [envVar: 'PUBLIC_TOKEN', vaultKey: 'public-token'], | |
| [envVar: 'API_KEY', vaultKey: 'api-key']]], | |
| ] | |
| def configuration = [vaultUrl: 'http://my-vault.com:8200', vaultCredentialId: 'vault-approle', engineVersion: 2] | |
| pipeline { | |
| agent any |
tbeyer567
/ gist:f60b6c09a221429024ae9a49625bcd59
Created
June 27, 2022 22:17
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| { | |
| "keys": [ | |
| { | |
| "kty": "RSA", | |
| "kid": "kewiQq9jiC84CvSsJYOB-N6A8WFLSV20Mb-y7IlWDSQ", | |
| "e": "AQAB", | |
| "n": "5RyvCSgBoOGNE03CMcJ9Bzo1JDvsU8XgddvRuJtdJAIq5zJ8fiUEGCnMfAZI4of36YXBuBalIycqkgxrRkSOENRUCWN45bf8xsQCcQ8zZxozu0St4w5S-aC7N7UTTarPZTp4BZH8ttUm-VnK4aEdMx9L3Izo0hxaJ135undTuA6gQpK-0nVsm6tRVq4akDe3OhC-7b2h6z7GWJX1SD4sAD3iaq4LZa8y1mvBBz6AIM9co8R-vU1_CduxKQc3KxCnqKALbEKXm0mTGsXha9aNv3pLNRNs_J-cCjBpb1EXAe_7qOURTiIHdv8_sdjcFTJ0OTeLWywuSf7mD0Wpx2LKcD6ImENbyq5IBuR1e2ghnh5Y9H33cuQ0FRni8ikq5W3xP3HSMfwlayhIAJN_WnmbhENRU-m2_hDPiD9JYF2CrQneLkE3kcazSdtarPbg9ZDiydHbKWCV-X7HxxIKEr9N7P1V5HKatF4ZUrG60e3eBnRyccPwmT66i9NYyrcy1_ZNN8D1DY8xh9kflUDy4dSYu4R7AEWxNJWQQov525v0MjD5FNAS03rpk4SuW3Mt7IP73m-_BpmIhW3LZsnmfd8xHRjf0M9veyJD0--ETGmh8t3_CXh3I3R9IbcSEntUl_2lCvc_6B-m8W-t2nZr4wvOq9-iaTQXAn1Au6EaOYWvDRE", | |
| "use": "sig", | |
| "alg": "RS256" | |
| }, |
tbeyer567
/ gist:f685c3a7b1396e167d2cae6be19e01ca
Created
June 27, 2022 22:50
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| image: | |
| name: vault | |
| variables: | |
| VAULT_ADDR: https://sensible-crow.butters.rocks:8200/ | |
| read_secrets: | |
| script: | |
| - export VAULT_CACERT=/builds/tbeyer/right-flounder/ca.pem | |
| - export VAULT_TOKEN="$(vault write -field=token auth/jwt/login role=demo-service-staging jwt=$CI_JOB_JWT)" |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| provider "aws" { | |
| region = var.region | |
| } | |
| resource "aws_vpc" "main" { | |
| cidr_block = var.vpc_cidr_block | |
| enable_dns_hostnames = true | |
| tags = { | |
| Name = var.vpc_name |
tbeyer567
/ vault admin policy
Created
January 17, 2023 19:20
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Read system health check | |
| path "sys/health" | |
| { | |
| capabilities = ["read", "sudo"] | |
| } | |
| # Create and manage ACL policies broadly across Vault | |
| # List existing policies | |
| path "sys/policies/acl" |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Manage auth methods broadly across Vault | |
| path "auth/*" | |
| { | |
| capabilities = ["create", "read", "update", "delete", "list", "sudo"] | |
| } | |
| # Create, update, and delete auth methods | |
| path "sys/auth/*" | |
| { | |
| capabilities = ["create", "update", "delete", "sudo"] |