kenpat
dbcf51993d
Replaces .env files across all KiteStacks apps. Vault runs as a Docker container bound to 127.0.0.1:8200 with file storage backend. - apps/vault/: compose file + vault.hcl config (TLS disabled, localhost only) - scripts/vault-env.sh: fetches secret from Vault KV and injects as env vars before running docker compose (drops the .env pattern entirely) - scripts/vault-init.sh: one-time init — GPG-encrypts unseal keys to ~/.vault-keys.gpg, creates kitestacks policy + limited app token - scripts/vault-unseal.sh: post-restart unseal via GPG-decrypted key - docs/vault-setup.md: full setup guide including secret migration steps Usage: vault-env.sh kitestacks/authentik -- docker compose up -d Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
15 lines
359 B
HCL
15 lines
359 B
HCL
storage "file" {
|
|
path = "/vault/data"
|
|
}
|
|
|
|
listener "tcp" {
|
|
address = "0.0.0.0:8200"
|
|
tls_disable = true
|
|
}
|
|
|
|
# Only accept connections from localhost and internal Docker network.
|
|
# Vault is NOT exposed on a public port — access via SSH tunnel or from monk only.
|
|
api_addr = "http://127.0.0.1:8200"
|
|
cluster_addr = "http://127.0.0.1:8201"
|
|
|
|
ui = true
|