vault/config/init.sh - master - syncora/main

vault/config/init.sh
62 строки2 KB
ikarg
add vault
09 окт 2025, 14:58
09 окт 2025, 14:58a3ba4ce
#!/bin/sh

until nc -z $VAULT_IP 8200; do
    echo "Ждём порт Vault..."
    sleep 1
done

sleep 3

echo "Vault запущен, инициализация"

INIT_DIR="/vault/init"
mkdir -p "$INIT_DIR"

STATUS=$(vault status -format=json || true)
INITIALIZED=$(echo "$STATUS" | jq -r ".initialized // false")
SEALED=$(echo "$STATUS" | jq -r ".sealed // true")

if [ "$INITIALIZED" != "true" ]; then
    echo "Инициализация Vault..."
    vault operator init -key-shares=1 -key-threshold=1 -format=json > "$INIT_DIR/init.json"
fi

UNSEAL_KEY=$(jq -r '.unseal_keys_b64[0]' "$INIT_DIR/init.json")
ROOT_TOKEN=$(jq -r '.root_token' "$INIT_DIR/init.json")

echo "{\"unseal_key\":\"$UNSEAL_KEY\",\"root_token\":\"$ROOT_TOKEN\"}" > "$INIT_DIR/keys.json"
chmod 600 "$INIT_DIR/keys.json"

STATUS=$(vault status -format=json || true)
SEALED=$(echo "$STATUS" | jq -r '.sealed // true')

if [ "$SEALED" = "true" ]; then
    echo "Разархивация Vault..."
    vault operator unseal "$UNSEAL_KEY"
fi

echo "Логин в Vault..."
vault login "$ROOT_TOKEN" >/dev/null 2>&1

echo "Проверяем, включён ли секретный движок..."
if ! vault secrets list -format=json | jq -e '."secret/"' >/dev/null; then
    echo "Включаем KV v2 на пути secret/"
    vault secrets enable -path=secret kv-v2 >/dev/null
else
    echo "KV v2 уже включён"
fi


VAULT_USER_NAME="${VAULT_USER_NAME}"
VAULT_USER_PASSWORD_FILE="/run/secrets/vault_user_password"

echo "Создаём пользователя $VAULT_USER_NAME..."
vault auth enable userpass >/dev/null 2>&1 || true

vault policy write user-policy /vault/config/policy.hcl

vault write auth/userpass/users/${VAULT_USER_NAME} \
    password="$(cat "$VAULT_USER_PASSWORD_FILE")" \
    policies=user-policy >/dev/null 2>&1 || true

echo "Vault готов. Пользователь $VAULT_USER_NAME создан."