| #!/bin/bash |
| |
| if [[ -f /opt/vault/tls/tls.crt ]] && [[ -f /opt/vault/tls/tls.key ]]; then |
| echo "Vault TLS key and certificate already exist. Exiting." |
| exit 0 |
| fi |
| |
| echo "Generating Vault TLS key and self-signed certificate..." |
| |
| # Create TLS and Data directory |
| mkdir --parents /opt/vault/tls |
| mkdir --parents /opt/vault/data |
| |
| # Generate TLS key and certificate |
| cd /opt/vault/tls |
| openssl req \ |
| -out tls.crt \ |
| -new \ |
| -keyout tls.key \ |
| -newkey rsa:4096 \ |
| -nodes \ |
| -sha256 \ |
| -x509 \ |
| -subj "/O=HashiCorp/CN=Vault" \ |
| -days 1095 # 3 years |
| |
| # Update file permissions |
| chown --recursive vault:vault /etc/vault.d |
| chown --recursive vault:vault /opt/vault |
| chmod 600 /opt/vault/tls/tls.crt /opt/vault/tls/tls.key |
| chmod 700 /opt/vault/tls |
| |
| echo "Vault TLS key and self-signed certificate have been generated in '/opt/vault/tls'." |
| |
| # Set IPC_LOCK capabilities on vault |
| setcap cap_ipc_lock=+ep /usr/bin/vault |
| |
| if [ -d /run/systemd/system ]; then |
| systemctl --system daemon-reload >/dev/null || true |
| fi |
| |
| if [[ $(vault version) == *+ent* ]]; then |
| echo " |
| The following shall apply unless your organization has a separately signed Enterprise License Agreement or Evaluation Agreement governing your use of the software: |
| Software in this repository is subject to the license terms located in the software, copies of which are also available at https://eula.hashicorp.com/ClickThruELA-Global.pdf or https://www.hashicorp.com/terms-of-evaluation as applicable. Please read the license terms prior to using the software. Your installation and use of the software constitutes your acceptance of these terms. If you do not accept the terms, do not use the software. |
| " |
| fi |
