Tim Beyer tbeyer567
tbeyer567
/ vault admin policy
Created
January 17, 2023 19:20
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Read system health check | |
| path "sys/health" | |
| { | |
| capabilities = ["read", "sudo"] | |
| } | |
| # Create and manage ACL policies broadly across Vault | |
| # List existing policies | |
| path "sys/policies/acl" |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| provider "aws" { | |
| region = var.region | |
| } | |
| resource "aws_vpc" "main" { | |
| cidr_block = var.vpc_cidr_block | |
| enable_dns_hostnames = true | |
| tags = { | |
| Name = var.vpc_name |
tbeyer567
/ gist:f685c3a7b1396e167d2cae6be19e01ca
Created
June 27, 2022 22:50
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| image: | |
| name: vault | |
| variables: | |
| VAULT_ADDR: https://sensible-crow.butters.rocks:8200/ | |
| read_secrets: | |
| script: | |
| - export VAULT_CACERT=/builds/tbeyer/right-flounder/ca.pem | |
| - export VAULT_TOKEN="$(vault write -field=token auth/jwt/login role=demo-service-staging jwt=$CI_JOB_JWT)" |
tbeyer567
/ gist:f60b6c09a221429024ae9a49625bcd59
Created
June 27, 2022 22:17
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| { | |
| "keys": [ | |
| { | |
| "kty": "RSA", | |
| "kid": "kewiQq9jiC84CvSsJYOB-N6A8WFLSV20Mb-y7IlWDSQ", | |
| "e": "AQAB", | |
| "n": "5RyvCSgBoOGNE03CMcJ9Bzo1JDvsU8XgddvRuJtdJAIq5zJ8fiUEGCnMfAZI4of36YXBuBalIycqkgxrRkSOENRUCWN45bf8xsQCcQ8zZxozu0St4w5S-aC7N7UTTarPZTp4BZH8ttUm-VnK4aEdMx9L3Izo0hxaJ135undTuA6gQpK-0nVsm6tRVq4akDe3OhC-7b2h6z7GWJX1SD4sAD3iaq4LZa8y1mvBBz6AIM9co8R-vU1_CduxKQc3KxCnqKALbEKXm0mTGsXha9aNv3pLNRNs_J-cCjBpb1EXAe_7qOURTiIHdv8_sdjcFTJ0OTeLWywuSf7mD0Wpx2LKcD6ImENbyq5IBuR1e2ghnh5Y9H33cuQ0FRni8ikq5W3xP3HSMfwlayhIAJN_WnmbhENRU-m2_hDPiD9JYF2CrQneLkE3kcazSdtarPbg9ZDiydHbKWCV-X7HxxIKEr9N7P1V5HKatF4ZUrG60e3eBnRyccPwmT66i9NYyrcy1_ZNN8D1DY8xh9kflUDy4dSYu4R7AEWxNJWQQov525v0MjD5FNAS03rpk4SuW3Mt7IP73m-_BpmIhW3LZsnmfd8xHRjf0M9veyJD0--ETGmh8t3_CXh3I3R9IbcSEntUl_2lCvc_6B-m8W-t2nZr4wvOq9-iaTQXAn1Au6EaOYWvDRE", | |
| "use": "sig", | |
| "alg": "RS256" | |
| }, |
tbeyer567
/ gist:3a5fb9e1916c4afb0cb4fb8aba17dad8
Created
June 22, 2022 22:10
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| def secrets = [ | |
| [path: 'secret/jenkins/github', engineVersion: 2, secretValues: [ | |
| [envVar: 'PRIVATE_TOKEN', vaultKey: 'private-token'], | |
| [envVar: 'PUBLIC_TOKEN', vaultKey: 'public-token'], | |
| [envVar: 'API_KEY', vaultKey: 'api-key']]], | |
| ] | |
| def configuration = [vaultUrl: 'http://my-vault.com:8200', vaultCredentialId: 'vault-approle', engineVersion: 2] | |
| pipeline { | |
| agent any |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| [ca] | |
| default_ca = CA_default | |
| [ CA_default ] | |
| # Directory and file locations. | |
| dir = . | |
| certs = $dir/certs | |
| crl_dir = $dir/crl | |
| new_certs_dir = $dir/newcerts | |
| database = $dir/index.txt |
tbeyer567
/ agent-policy.hcl
Created
May 16, 2022 15:10
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| path "auth/approle/role/agent/role-id" { | |
| capabilities=["read"] | |
| } | |
| path "auth/approle/role/agent/secret-id" { | |
| capabilities=["read","update"] | |
| } | |
| path "kv/data/application/db01" { | |
| capabilities=["read"] |
tbeyer567
/ vault logrotate
Created
April 5, 2022 18:20
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| /var/log/vault/audit.json { | |
| rotate 7 | |
| daily | |
| compress | |
| delaycompress | |
| missingok | |
| notifempty | |
| extension json | |
| dateext | |
| dateformat %Y-%m-%d. |
tbeyer567
/ su-policy.hcl
Created
March 30, 2022 17:28
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| path "*" { | |
| capabilities = ["create", "read", "update", "delete", "list", "sudo"] | |
| } |
tbeyer567
/ vault install script
Last active
July 14, 2022 18:54
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| #!/usr/bin/env bash | |
| set -euxo pipefail | |
| export VAULT_NODE_ID="GIEGTIVLP18994C" | |
| export VAULT_NODE_IP_ADDR="10.27.84.13" | |
| echo "Installing Vault Enterpise" | |
| sudo cp /tmp/vault /usr/bin/ |