mirror of
https://github.com/sol1/rustguac.git
synced 2026-09-11 01:55:38 +00:00
Dave Kempe
d1adea5bea
Single shell script in contrib/ that takes a fresh box from "no Vault" to
"rustguac-ready Vault" without copy-pasting the integrations.md walkthrough.
Three modes:
bootstrap (default) Provision an existing Vault using $VAULT_ADDR and
$VAULT_TOKEN. Just creates the policy, AppRole, and
prints the rustguac config snippet.
--dev Spawn `<cli> server -dev` first (in-memory, root
token = "root"), then bootstrap it. For demos and
throwaway local development.
--local Install Vault or OpenBao as a systemd service on
this host with file-backed storage and on-disk
auto-unseal via an ExecStartPost helper. The unseal
key sits at <config_dir>/unseal-key (0400 root:root)
and a SECURITY.txt is written next to it spelling
out the convenience-over-security trade. Single-host
boxes only; for anything else use cloud-KMS unseal.
Auto-detects vault vs bao and picks the right filesystem layout, system
user, and service name for each (vault: /etc/vault.d, vault.service,
vault:vault; openbao: /etc/openbao, openbao.service, openbao:openbao).
Both flavors use the same HCL config grammar so the rest of the script is
shared.
Idempotent: re-running detects existing user, mount, policy, AppRole,
init bundle, and systemd unit. Drop-in is used if a unit already exists
(apt-installed vault) instead of clobbering it.
The script does NOT install the binary itself - it errors cleanly if
vault/bao isn't in PATH and tells the operator to install one.