mirror of
https://github.com/BagelHole/DevOps-Security-Agent-Skills.git
synced 2026-08-22 12:49:53 +02:00
63 lines
1.4 KiB
HCL
63 lines
1.4 KiB
HCL
|
# Vault Server Configuration
|
||
|
|
# /etc/vault.d/vault.hcl
|
||
|
|
|
||
|
|
# Cluster name
|
||
|
|
cluster_name = "production"
|
||
|
|
|
||
|
|
# Storage backend (Raft for HA)
|
||
|
|
storage "raft" {
|
||
|
|
path = "/opt/vault/data"
|
||
|
|
node_id = "vault-1"
|
||
|
|
|
||
|
|
retry_join {
|
||
|
|
leader_api_addr = "https://vault-2.example.com:8200"
|
||
|
|
}
|
||
|
|
retry_join {
|
||
|
|
leader_api_addr = "https://vault-3.example.com:8200"
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
# Listener configuration
|
||
|
|
listener "tcp" {
|
||
|
|
address = "0.0.0.0:8200"
|
||
|
|
cluster_address = "0.0.0.0:8201"
|
||
|
|
tls_cert_file = "/opt/vault/tls/vault.crt"
|
||
|
|
tls_key_file = "/opt/vault/tls/vault.key"
|
||
|
|
|
||
|
|
# TLS settings
|
||
|
|
tls_min_version = "tls12"
|
||
|
|
tls_cipher_suites = "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"
|
||
|
|
}
|
||
|
|
|
||
|
|
# API address
|
||
|
|
api_addr = "https://vault.example.com:8200"
|
||
|
|
cluster_addr = "https://vault-1.example.com:8201"
|
||
|
|
|
||
|
|
# UI
|
||
|
|
ui = true
|
||
|
|
|
||
|
|
# Telemetry
|
||
|
|
telemetry {
|
||
|
|
prometheus_retention_time = "30s"
|
||
|
|
disable_hostname = true
|
||
|
|
}
|
||
|
|
|
||
|
|
# Audit logging
|
||
|
|
# Enable via API after init:
|
||
|
|
# vault audit enable file file_path=/var/log/vault/audit.log
|
||
|
|
|
||
|
|
# Seal configuration (Auto-unseal with AWS KMS)
|
||
|
|
# seal "awskms" {
|
||
|
|
# region = "us-east-1"
|
||
|
|
# kms_key_id = "alias/vault-unseal-key"
|
||
|
|
# }
|
||
|
|
|
||
|
|
# Performance settings
|
||
|
|
max_lease_ttl = "768h"
|
||
|
|
default_lease_ttl = "768h"
|
||
|
|
disable_mlock = false
|
||
|
|
disable_cache = false
|
||
|
|
|
||
|
|
# Plugin directory
|
||
|
|
plugin_directory = "/opt/vault/plugins"
|