[Support] Vault


Recommended Posts

Application Name: Vault

Application Sitehttps://www.vaultproject.io/

Docker Hubhttps://hub.docker.com/_/vault

Githubhttps://github.com/hashicorp/docker-vault

 

Manage secrets and protect sensitive data. Create and secure access to tokens, passwords, certificates, and encryption keys.

 

Vault is a tool for securely accessing secrets. A secret is anything that you want to tightly control access to, such as API keys, passwords, certificates, and more. Vault provides a unified interface to any secret, while providing tight access control and recording a detailed audit log.

 

Here is a video about this container.

 

 

This image is an official one, I do not manage it, though, I will do my best to support it here.

 

The app is going to install HashiCorp Vault with a file backend (default), you can change this backend if you want to, with other parameters in VAULT_LOCAL_CONFIG variable :

NOTE : At startup, the container will read configuration HCL and JSON files from /vault/config (any information passed into VAULT_LOCAL_CONFIG is written into local.json in this directory and read as part of reading the directory for configuration files).

Please see Vault's configuration documentation for a full list of options.

{"backend": {"file": {"path": "/vault/file"}},"listener": {"tcp": {"address": "0.0.0.0:8200", "tls_disable": 1}}, "ui": true}


Port :

 

Vault is using port 8200 (default).

 

Volumes :

 

We have two volumes in your installation :

 

- file : mandatory as you want the secrets to persist to your disks.

- logs : only if you want to audit logs. (commands in General usage section)

 

Setup :

 

You can setup  Vault from the WebUI, but I will go with the CLI.

 

After launching the app, install vault in your OS as a client : https://www.vaultproject.io/downloads

 

Set VAULT_ADDR to your Unraid server IP.

 

export VAULT_ADDR='http://192.168.0.100:8200'

 

Create key shares and set a threshold about how many keys you need to unseal Vault.

 

vault operator init -key-shares=6 -key-threshold=3

 

e.g output (Keep these keys and Root token safe and do not share them!):

 

Unseal Key 1: xDElr...IofCZFSvPe
Unseal Key 2: 2TQgn...vyQ7fSdSWR
Unseal Key 3: JALI...EpHFSw7SsI
Unseal Key 4: knzg...xEFwfwWSbKQ
Unseal Key 5: bJJmA...DSwfsddOTc
Unseal Key 6: xft8...aTdVSTYZg5

Initial Root Token: hvs.tnhE...y8NkA

 

Run unseal command 3 times with different keys every time (depends of your threshold number):

NOTE :  best practice would be to not write the key directly, and only type "vault operator unseal", so the keys is not in your cli history.

vault operator unseal xDElr...IofCZFSvPe
vault operator unseal 2TQgn...vyQ7fSdSWR
vault operator unseal knzg...xEFwfwWSbKQ

 

After 3 times running this command, you should see

Sealed          false

 

Now Vault is unsealed, you can login to vault :

NOTE :  best practice would be to not write the token directly, and only type "vault login", so the token is not in your cli history.

vault login hvs.tnhE...y8NkA

 

Example Usage :

 

There is many secret engine you can use : https://www.vaultproject.io/docs/secrets/

In this example, I will use the KV Engine as it's the most basic one.

 

Enable the KV (Key Value) Engine https://www.vaultproject.io/docs/secrets/kv :

vault secrets enable -version=1 -path=secret kv

 

Create our first secret :

vault kv put secret/my-vault/password password=123456

 

List our secret :

vault kv list secret/

vault kv list secret/my-vault/

 

Read the secret (defaults in table format):

vault kv get secret/my-vault/password
====== Data ======
Key         Value
---         -----
password    123456

 

Read the secret in json format:

vault kv get --format=json secret/my-vault/password
{
  "request_id": "31915c6c-2f8f-f7c4-146c-3dc81e80033c",
  "lease_id": "",
  "lease_duration": 2764800,
  "renewable": false,
  "data": {
    "password": "123456"
  },
  "warnings": null
}

 

Read only the password value in the secret:

vault kv get -field=password secret/my-vault/password
123456

 

Create a key with multiple secrets :

vault kv put secret/nextcloud/db db_name=nextcloud username=nextcloud_user password=secret

 

Read secrets in json

vault kv get --format=json secret/nextcloud/db
{
  "request_id": "db9604e4-f2eb-a529-c7f3-448b2846f565",
  "lease_id": "",
  "lease_duration": 2764800,
  "renewable": false,
  "data": {
    "db_name": "nextcloud",
    "password": "secret",
    "username": "nextcloud_user"
  },
  "warnings": null
}

 

Only read username field :

vault kv get -field=username secret/nextcloud/db
nextcloud_user

 

Delete our secrets :

vault kv delete secret/nextcloud/db

 

If you want to activate the audit logs :

vault audit enable file file_path=/vault/logs/vault_audit.log

 

If you want to disable the audit logs : 

vault audit disable file

 

Vault is pretty fun and there is ton of different usages, from your bash scripts, in your code, in your CI/CD pipeline, SSH OTP, dynamic secrets, cloud provider authentication... have fun!

 

Please post any questions/issues relating to this docker you have in this thread.

Edited by kastem34
Being more concise
  • Like 2
Link to comment
  • 2 weeks later...

Can you use vault to store docker secrets? I am not aware of any way to based on the docs but thought I would ask. An example is, say, a DB connection you are passing creds to in a docker application in unraid.  I know you can use docker secrets (not easily in unraid) but vault would be nice to use for this.

Link to comment
  • 2 months later...
  • 2 months later...
  • 6 months later...

I am not able to start the container. I get the following:

 

Unable to find image 'vault:latest' locally
docker: Error response from daemon: manifest for vault:latest not found: manifest unknown: manifest unknown.
See 'docker run --help'.

 

I have tried :latest, :1.14, 1:13 and they all end in the same error. I was able to successfully install another container after trying this one so I don't believe it is something unraid/my system related.

Link to comment
6 hours ago, LTM said:

I am not able to start the container. I get the following:

 

Unable to find image 'vault:latest' locally
docker: Error response from daemon: manifest for vault:latest not found: manifest unknown: manifest unknown.
See 'docker run --help'.

 

I have tried :latest, :1.14, 1:13 and they all end in the same error. I was able to successfully install another container after trying this one so I don't believe it is something unraid/my system related.

Same issue here. 

Link to comment

I was able to fix this by adjusting the docker extra parameters. The template lists "vault server" after the memory lock option in extra parameters, I believe the docker run command is accepting this as the repository value instead of hashicorp/vault. From the Vault Docker hub site it only shows server as the post command argument, vault appears to not be needed. Full disclosure though I'm by no means a Vault expert, I was just trying to spin up the container to try it out.

1967033526_Dockerrunoutput.thumb.png.14aad362443fa36d093af2509dd42503.png1415715633_Templatechange.thumb.png.dd2439fced83690b287e49dfe0767815.png

Link to comment
21 minutes ago, jinx8503 said:

I was able to fix this by adjusting the docker extra parameters. The template lists "vault server" after the memory lock option in extra parameters, I believe the docker run command is accepting this as the repository value instead of hashicorp/vault. From the Vault Docker hub site it only shows server as the post command argument, vault appears to not be needed. Full disclosure though I'm by no means a Vault expert, I was just trying to spin up the container to try it out.

1967033526_Dockerrunoutput.thumb.png.14aad362443fa36d093af2509dd42503.png1415715633_Templatechange.thumb.png.dd2439fced83690b287e49dfe0767815.png

 

Thank you for the hint, I have updated the template, in like 2 hours from now it should be updated, feel free to tell me if it works.

Edited by kastem34
Link to comment
22 hours ago, kastem34 said:

 

Thank you for the hint, I have updated the template, in like 2 hours from now it should be updated, feel free to tell me if it works.

Worked for me, I removed the container and previous template. I reinstalled the container from Community Applications and the container started up without issues, Thanks!

Link to comment
  • 5 months later...

Does the Vault/File folder have to be on the cache drive or can it live on the array?  I would prefer the protection for such data on the array.

 

Thank you for creating this unRAID template!  I appreciate the work that the Devs do to make our OS AWESOME! Thank you for your time and help.

Edited by Rudder2
I suck at spelling...
Link to comment

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.

Guest
Reply to this topic...

×   Pasted as rich text.   Restore formatting

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.