.

security/secrets/hashicorp-vault/assets/vault-config.hcl

@@ -0,0 +1,62 @@
+# Vault Server Configuration
+# /etc/vault.d/vault.hcl
+
+# Cluster name
+cluster_name = "production"
+
+# Storage backend (Raft for HA)
+storage "raft" {
+  path    = "/opt/vault/data"
+  node_id = "vault-1"
+  
+  retry_join {
+    leader_api_addr = "https://vault-2.example.com:8200"
+  }
+  retry_join {
+    leader_api_addr = "https://vault-3.example.com:8200"
+  }
+}
+
+# Listener configuration
+listener "tcp" {
+  address         = "0.0.0.0:8200"
+  cluster_address = "0.0.0.0:8201"
+  tls_cert_file   = "/opt/vault/tls/vault.crt"
+  tls_key_file    = "/opt/vault/tls/vault.key"
+  
+  # TLS settings
+  tls_min_version = "tls12"
+  tls_cipher_suites = "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"
+}
+
+# API address
+api_addr     = "https://vault.example.com:8200"
+cluster_addr = "https://vault-1.example.com:8201"
+
+# UI
+ui = true
+
+# Telemetry
+telemetry {
+  prometheus_retention_time = "30s"
+  disable_hostname          = true
+}
+
+# Audit logging
+# Enable via API after init:
+# vault audit enable file file_path=/var/log/vault/audit.log
+
+# Seal configuration (Auto-unseal with AWS KMS)
+# seal "awskms" {
+#   region     = "us-east-1"
+#   kms_key_id = "alias/vault-unseal-key"
+# }
+
+# Performance settings
+max_lease_ttl         = "768h"
+default_lease_ttl     = "768h"
+disable_mlock         = false
+disable_cache         = false
+
+# Plugin directory
+plugin_directory = "/opt/vault/plugins"