README

UPDATE: Vault (hashicorp) provides docker images now.  Use those, we do.

VAULT
(Hashicorp Vault)
https://github.com/hashicorp/vault

NOTE: stuck @ <= v0.6.0-rebuild, until centurylink/builder is upgraded to golang 1.7.

I wanted a full, ready to use vault image for docker. I couldn't find one that
 wasn't either huge, or incomplete.  This is my hopefully "complete" one that
  uses a "scratch" (or very nearly actually) image.

I use centurylink/ca-certs instead of scratch, because it has the CA carts in it.
Otherwise it is a scratch image.

vault-src == vault source.
build.sh == (script to checkout vault and build image)
Dockerfile == (Docker config file to build image)
docker-compose.yml ==  (a docker compose config to run vault)
gencert.sh == (a crappy way to generate a self-signed cert) -- DO NOT USE FOR PRODUCTION.
            GET A REAL CERT DUDE.  for this build name them server.crt and server.key
supervisor-vault.conf ==  if you don't want to use docker-compose, you can use supervisord to run docker vault
vault.hcl ==  vault's configuration file.

server.key == your SSL cert private key (you have to provide this)
server.crt == your SSL cert public key (you have to provide this)
to build vault image:

(run ./build.sh OR):

	#clone the repo
	git clone https://github.com/hashicorp/vault vault-src
	cd vault-src

	#go to latest version (by the time you read this, there may be a new release)
	git checkout v0.6.0-rebuild

	#put this in your Dockerfile:
	FROM centurylink/ca-certs
	EXPOSE 8200
	COPY bin/vault /
	COPY vault.hcl /
	ENTRYPOINT ["/vault"]

build.sh includes a call to ../gencert.py vault (that will generate a certificate for hostname vault.service.consul).

#Run this to build (notice the :v0.6.0 -- change to version you checked out above):
docker run --rm -v "$(pwd):/src" -v /var/run/docker.sock:/var/run/docker.sock -e OUTPUT=bin/vault centurylink/golang-builder vault:v0.6.0

#run vault:
docker run --rm --net=host -p 8200:8200 vault:v0.6.0-rebuild server -config=/vault.hcl

# use vault locally:
alias vault='docker exec -it vault /vault "$@"

# use vault remotely:
(install vault binary)
export VAULT_ADDR="https://vault.service.consul:8200"
vault ......