Vault 架設手冊

ssh jedi@192.168.50.172

wget -O - https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor -o /usr/share/keyrings/hashicorp-archive-keyring.gpg

echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list

sudo apt update && sudo apt install -y vault jq
vault version

T=/opt/vault/tls
sudo mkdir -p $T

# CA（10 年）
sudo openssl genrsa -out $T/vault-ca.key 4096
sudo openssl req -x509 -new -key $T/vault-ca.key -sha256 -days 3650 -subj "/CN=Guidant Release Vault CA" -out $T/vault-ca.pem

# 伺服器憑證（2 年），SAN 要含 IP 與主機名
sudo openssl genrsa -out $T/vault-key.pem 2048
sudo openssl req -new -key $T/vault-key.pem -subj "/CN=hashicorp-vault" -out $T/vault.csr
printf "subjectAltName=IP:192.168.50.172,IP:127.0.0.1,DNS:hashicorp-vault,DNS:localhost\nextendedKeyUsage=serverAuth\n" | sudo tee $T/vault.ext >/dev/null
sudo openssl x509 -req -in $T/vault.csr -CA $T/vault-ca.pem -CAkey $T/vault-ca.key -CAcreateserial -days 730 -sha256 -extfile $T/vault.ext -out $T/vault-cert.pem

sudo chown -R vault:vault $T
sudo chmod 600 $T/vault-ca.key $T/vault-key.pem
sudo chmod 644 $T/vault-ca.pem $T/vault-cert.pem

# CA 憑證是公開的，放一份 jedi 讀得到的位置給 CLI 用（$T 本身 jedi 進不去）
sudo cp $T/vault-ca.pem /etc/vault.d/vault-ca.pem && sudo chmod 644 /etc/vault.d/vault-ca.pem
sudo ls -l $T
sudo openssl x509 -in $T/vault-cert.pem -noout -subject -ext subjectAltName -enddate

sudo tee /etc/vault.d/vault.hcl >/dev/null <<'EOF'
# ── Guidant AI 出版簽章金庫（192.168.50.172）────────────────────────────
# 架法與每一段為什麼這樣設，見 repo docs/features/FR-173-2611-release-pipeline/vault-setup-runbook.md

# 開網頁管理介面：瀏覽器開 https://192.168.50.172:8200/ui 就能看狀態、登入、查鑰匙。
# 走同一個 8200 埠、同一張 TLS 憑證，不另開埠。
ui = true

# 不鎖定記憶體。Vault 預設會把記憶體鎖住、避免祕密被換頁寫到磁碟；
# 但內建儲存（Raft）用的是記憶體對映檔，兩者一起開會吃光記憶體，官方要求這種儲存一定要關。
# 這台不開 swap 就沒有換頁風險（Ubuntu 預設有小 swap，要的話 sudo swapoff -a 並註解掉 /etc/fstab 那行）。
disable_mlock = true

# 對外公告「找我請打這個網址」。GitLab runner、CLI、網頁介面重新導向都用它，
# 所以要填別台機器連得到的 IP，不能填 127.0.0.1。
api_addr = "https://192.168.50.172:8200"

# 叢集節點之間互相溝通用的位址。這台是單節點，沒有別的節點要連，綁本機就好。
# 日後要加第二台做備援時才改成對外 IP。
cluster_addr = "https://127.0.0.1:8201"

# ── 監聽：Vault 在哪個埠收請求 ───────────────────────────────────────────
listener "tcp" {
  # 收 API 與網頁請求的埠。0.0.0.0 表示所有網卡都聽，誰能連進來由第 4 段防火牆決定
  #（只放 188 與決策者 Mac）。
  address = "0.0.0.0:8200"

  # 叢集埠只聽本機，外面連不到（單節點用不到）。
  cluster_address = "127.0.0.1:8201"

  # 第 2 段簽出來的伺服器憑證與私鑰。所有連線都加密，不准走明文 http。
  tls_cert_file = "/opt/vault/tls/vault-cert.pem"
  tls_key_file  = "/opt/vault/tls/vault-key.pem"

  # 最低只接受 TLS 1.2，擋掉舊版不安全的協定。
  tls_min_version = "tls12"
}

# ── 儲存：鑰匙與設定存在哪 ───────────────────────────────────────────────
# 用 Vault 內建的 Raft 儲存，不必另外裝資料庫。磁碟上的內容全部加密，
# 沒有解封鑰匙打不開；簽章私鑰就存在這裡面。
storage "raft" {
  # 資料目錄。每天的快照（第 10 段）就是從這裡拍的。
  path = "/opt/vault/data"

  # 這個節點的名字，叢集裡辨識用。單節點隨便取但取了就不要改，改了要重建。
  node_id = "release-vault-1"
}
EOF
sudo chown vault:vault /etc/vault.d/vault.hcl && sudo chmod 640 /etc/vault.d/vault.hcl
sudo mkdir -p /opt/vault/data && sudo chown -R vault:vault /opt/vault/data
vault operator diagnose -config=/etc/vault.d/vault.hcl -skip=storage 2>&1 | tail -15

sudo ufw allow OpenSSH
sudo ufw allow from 192.168.50.188 to any port 8200 proto tcp comment 'GitLab runner / build'
sudo ufw allow from <你的 Mac 的內網 IP> to any port 8200 proto tcp comment 'decision maker'
sudo ufw enable
sudo ufw status numbered

sudo systemctl enable --now vault
sudo systemctl status vault --no-pager | head -5

echo 'export VAULT_ADDR=https://127.0.0.1:8200' >> ~/.bashrc
echo 'export VAULT_CACERT=/etc/vault.d/vault-ca.pem' >> ~/.bashrc
source ~/.bashrc
vault status

vault operator init -key-shares=5 -key-threshold=3

vault operator unseal   # 貼第 1 把，Enter
vault operator unseal   # 貼第 2 把
vault operator unseal   # 貼第 3 把
vault status            # Sealed false

vault login             # 貼 root token

# 稽核 log：每次簽章誰簽、何時簽都記下來
sudo mkdir -p /var/log/vault && sudo chown vault:vault /var/log/vault
vault audit enable file file_path=/var/log/vault/audit.log
vault audit list

# Transit 引擎＋Ed25519 簽章鑰（不可匯出、不可刪）
vault secrets enable transit
vault write -f transit/keys/guidant-release type=ed25519
vault read transit/keys/guidant-release

vault write transit/sign/guidant-release input=$(printf 'hello' | base64)
# 回 signature = vault:v1:<base64>
vault write transit/verify/guidant-release input=$(printf 'hello' | base64) signature=<上一步的 vault:v1:...>
# 回 valid = true

vault read -format=json transit/keys/guidant-release | jq -r '.data.keys["1"].public_key'

vault policy write release-admin - <<'EOF'
path "sys/*"              { capabilities = ["create","read","update","delete","list","sudo"] }
path "auth/*"             { capabilities = ["create","read","update","delete","list","sudo"] }
path "transit/keys/*"     { capabilities = ["read","list","update"] }
path "transit/sign/*"     { capabilities = ["update"] }
path "transit/verify/*"   { capabilities = ["update"] }
path "kv/*"               { capabilities = ["create","read","update","delete","list"] }
EOF

vault auth enable userpass

read -rs -p '新密碼: ' P; echo
printf %s "$P" | vault write auth/userpass/users/jedi password=- policies=release-admin
unset P

vault login -no-store -method=userpass username=jedi > /dev/null && echo 試登成功

vault token revoke -self
vault login -method=userpass username=jedi > /dev/null
vault token lookup | grep -E "^(policies|display_name) "

vault operator generate-root -init                       # 記下 OTP 與 Nonce（不要貼出去）
vault operator generate-root -nonce=<Nonce>              # 跑三次，每次一把解封鑰匙；第三次印 Encoded Token
vault operator generate-root -decode=<Encoded Token> -otp=<OTP>   # 印出新的 root token
vault login                                              # 貼它；接著回到本段開頭重做，最後一樣撤銷

sudo mkdir -p /opt/vault/snapshots && sudo chown vault:vault /opt/vault/snapshots

# 快照用的最小權限 token（只能拿快照）
vault policy write snapshot - <<'EOF'
path "sys/storage/raft/snapshot" { capabilities = ["read"] }
EOF
vault token create -policy=snapshot -period=768h -display-name=daily-snapshot -field=token | sudo tee /etc/vault.d/snapshot.token >/dev/null
sudo chown root:root /etc/vault.d/snapshot.token && sudo chmod 600 /etc/vault.d/snapshot.token

sudo tee /etc/cron.daily/vault-snapshot >/dev/null <<'EOF'
#!/bin/sh
set -e
export VAULT_ADDR=https://127.0.0.1:8200 VAULT_CACERT=/opt/vault/tls/vault-ca.pem
export VAULT_TOKEN="$(cat /etc/vault.d/snapshot.token)"
vault token renew >/dev/null
f=/opt/vault/snapshots/vault-$(date +%Y%m%d).snap
vault operator raft snapshot save "$f"
chown vault:vault "$f"
find /opt/vault/snapshots -name 'vault-*.snap' -mtime +30 -delete
EOF
sudo chmod 755 /etc/cron.daily/vault-snapshot
sudo /etc/cron.daily/vault-snapshot && ls -la /opt/vault/snapshots/

# 在你的 Mac
scp jedi@192.168.50.172:/etc/vault.d/vault-ca.pem ~/.vault-ca.pem
curl --cacert ~/.vault-ca.pem https://192.168.50.172:8200/v1/sys/health
# 回 JSON，"sealed":false

# 在 188（從 Mac 轉一手過去）
scp ~/.vault-ca.pem jedi@192.168.50.188:/tmp/vault-ca.pem
ssh jedi@192.168.50.188 "sudo cp /tmp/vault-ca.pem /usr/local/share/ca-certificates/guidant-release-vault.crt && sudo update-ca-certificates && curl -s https://192.168.50.172:8200/v1/sys/health"

export VAULT_ADDR=https://127.0.0.1:8200 VAULT_CACERT=/etc/vault.d/vault-ca.pem
vault login -method=userpass username=jedi > /dev/null

vault write -f transit/keys/guidant-test type=ed25519
vault read transit/keys/guidant-test

vault policy write release-sign-dev - <<'EOF'
path "transit/sign/guidant-test"    { capabilities = ["update"] }
path "transit/keys/guidant-release" { capabilities = ["read"] }
path "transit/keys/guidant-test"    { capabilities = ["read"] }
EOF
read -rs P
printf '%s' "$P" | vault write auth/userpass/users/release-dev password=- token_policies=release-sign-dev token_ttl=1h
unset P

mkdir -p ~/.config/guidant
scp jedi@192.168.50.172:/etc/vault.d/vault-ca.pem ~/.config/guidant/vault-ca.pem

ssh jedi@192.168.50.172 'export VAULT_ADDR=https://127.0.0.1:8200 VAULT_CACERT=/etc/vault.d/vault-ca.pem; vault read -format=json transit/keys/guidant-test' \
  | python3 -c 'import sys,json,base64,hashlib;k=base64.b64decode(json.load(sys.stdin)["data"]["keys"]["1"]["public_key"]);kid=hashlib.sha256(k).hexdigest()[:16];der=bytes.fromhex("302a300506032b6570032100")+k;print(kid);open(f"/tmp/{kid}.pub","w").write("-----BEGIN PUBLIC KEY-----\n"+base64.b64encode(der).decode()+"\n-----END PUBLIC KEY-----\n")'

scp /tmp/<kid>.pub jedi@192.168.50.190:/tmp/ && ssh jedi@192.168.50.190 "sudo install -m 644 /tmp/<kid>.pub /etc/guidant/release-keys/<kid>.pub"

vault auth enable jwt
vault write auth/jwt/config oidc_discovery_url=https://gitlab.com bound_issuer=https://gitlab.com

vault secrets enable -path=kv kv-v2

vault policy write ci-release - <<'EOF'
path "transit/sign/guidant-release" { capabilities = ["update"] }
path "transit/keys/guidant-release" { capabilities = ["read"] }
path "kv/data/ci/*" { capabilities = ["read"] }
EOF

vault policy write ci-test - <<'EOF'
path "transit/sign/guidant-test" { capabilities = ["update"] }
path "transit/keys/guidant-test" { capabilities = ["read"] }
path "kv/data/ci/nexus" { capabilities = ["read"] }
path "kv/data/ci/harbor" { capabilities = ["read"] }
path "kv/data/ci/license-center" { capabilities = ["read"] }
EOF

vault write auth/jwt/role/release-ci - <<'EOF'
{
  "role_type": "jwt",
  "user_claim": "user_login",
  "bound_audiences": ["https://192.168.50.172:8200"],
  "token_policies": ["ci-release"],
  "token_ttl": "30m",
  "bound_claims": {
    "project_path": ["auditmanager/compliance-manager-be", "auditmanager/evidence-agent"],
    "ref_type": "tag",
    "ref_protected": "true",
    "user_id": ["21126655"]
  }
}
EOF

vault write auth/jwt/role/test-ci - <<'EOF'
{
  "role_type": "jwt",
  "user_claim": "user_login",
  "bound_audiences": ["https://192.168.50.172:8200"],
  "token_policies": ["ci-test"],
  "token_ttl": "30m",
  "bound_claims": {
    "project_path": ["auditmanager/compliance-manager-be", "auditmanager/evidence-agent"],
    "ref_type": "branch",
    "user_id": ["21126655"]
  }
}
EOF

vault policy write ci-classifier - <<'EOF'
path "kv/data/ci/harbor" { capabilities = ["read"] }
EOF

vault write auth/jwt/role/classifier-ci - <<'EOF'
{
  "role_type": "jwt",
  "user_claim": "user_login",
  "bound_audiences": ["https://192.168.50.172:8200"],
  "token_policies": ["ci-classifier"],
  "token_ttl": "30m",
  "bound_claims": {
    "project_path": "commonservice3/jedi-python-package",
    "user_id": ["21126655"]
  }
}
EOF