.

security/secrets/hashicorp-vault/scripts/vault-backup.sh

@@ -0,0 +1,55 @@
+#!/bin/bash
+# Vault Backup Script (Raft Storage)
+# Usage: ./vault-backup.sh [output-dir]
+
+set -euo pipefail
+
+OUTPUT_DIR="${1:-./vault-backups}"
+TIMESTAMP=$(date +%Y%m%d_%H%M%S)
+BACKUP_FILE="$OUTPUT_DIR/vault-snapshot-$TIMESTAMP.snap"
+
+mkdir -p "$OUTPUT_DIR"
+
+echo "========================================="
+echo "Vault Raft Snapshot Backup"
+echo "Output: $BACKUP_FILE"
+echo "========================================="
+echo ""
+
+# Check Vault status
+if ! vault status &>/dev/null; then
+    echo "Error: Cannot connect to Vault or Vault is sealed"
+    exit 1
+fi
+
+# Take snapshot
+echo "Creating snapshot..."
+vault operator raft snapshot save "$BACKUP_FILE"
+
+if [ -f "$BACKUP_FILE" ]; then
+    SIZE=$(du -h "$BACKUP_FILE" | cut -f1)
+    echo "Snapshot created successfully!"
+    echo "File: $BACKUP_FILE"
+    echo "Size: $SIZE"
+else
+    echo "Error: Snapshot creation failed"
+    exit 1
+fi
+
+# Verify snapshot
+echo ""
+echo "Verifying snapshot..."
+vault operator raft snapshot inspect "$BACKUP_FILE" | head -20
+
+# Cleanup old backups (keep last 7)
+echo ""
+echo "Cleaning up old backups (keeping last 7)..."
+ls -t "$OUTPUT_DIR"/vault-snapshot-*.snap 2>/dev/null | tail -n +8 | xargs -r rm -v
+
+echo ""
+echo "========================================="
+echo "Backup complete"
+echo ""
+echo "To restore:"
+echo "  vault operator raft snapshot restore $BACKUP_FILE"
+echo "========================================="

security/secrets/hashicorp-vault/scripts/vault-init.sh

@@ -0,0 +1,78 @@
+#!/bin/bash
+# Vault Initialization and Unseal Script
+# Usage: ./vault-init.sh [vault-addr]
+
+set -euo pipefail
+
+export VAULT_ADDR="${1:-http://127.0.0.1:8200}"
+
+echo "========================================="
+echo "Vault Initialization"
+echo "Address: $VAULT_ADDR"
+echo "========================================="
+echo ""
+
+# Check if Vault is already initialized
+INIT_STATUS=$(vault status -format=json 2>/dev/null | jq -r '.initialized' || echo "error")
+
+if [ "$INIT_STATUS" == "true" ]; then
+    echo "Vault is already initialized"
+    SEALED=$(vault status -format=json | jq -r '.sealed')
+    if [ "$SEALED" == "true" ]; then
+        echo "Vault is sealed. Use unseal keys to unseal."
+    else
+        echo "Vault is unsealed and ready."
+    fi
+    exit 0
+fi
+
+if [ "$INIT_STATUS" == "error" ]; then
+    echo "Error: Cannot connect to Vault at $VAULT_ADDR"
+    exit 1
+fi
+
+# Initialize Vault
+echo "Initializing Vault..."
+echo ""
+
+# Initialize with 5 key shares, 3 required to unseal
+INIT_OUTPUT=$(vault operator init \
+    -key-shares=5 \
+    -key-threshold=3 \
+    -format=json)
+
+# Save keys securely
+echo "$INIT_OUTPUT" > vault-init-keys.json
+chmod 600 vault-init-keys.json
+
+echo "Vault initialized successfully!"
+echo ""
+echo "IMPORTANT: vault-init-keys.json contains your unseal keys and root token"
+echo "Store these securely and distribute unseal keys to different people"
+echo ""
+
+# Extract keys
+UNSEAL_KEY_1=$(echo "$INIT_OUTPUT" | jq -r '.unseal_keys_b64[0]')
+UNSEAL_KEY_2=$(echo "$INIT_OUTPUT" | jq -r '.unseal_keys_b64[1]')
+UNSEAL_KEY_3=$(echo "$INIT_OUTPUT" | jq -r '.unseal_keys_b64[2]')
+ROOT_TOKEN=$(echo "$INIT_OUTPUT" | jq -r '.root_token')
+
+# Unseal Vault
+echo "Unsealing Vault..."
+vault operator unseal "$UNSEAL_KEY_1" >/dev/null
+vault operator unseal "$UNSEAL_KEY_2" >/dev/null
+vault operator unseal "$UNSEAL_KEY_3" >/dev/null
+
+echo "Vault unsealed successfully!"
+echo ""
+echo "Root Token: $ROOT_TOKEN"
+echo ""
+echo "Login with: vault login $ROOT_TOKEN"
+echo ""
+echo "========================================="
+echo "Next steps:"
+echo "1. Store unseal keys securely (different locations)"
+echo "2. Create AppRole or other auth methods"
+echo "3. Enable audit logging"
+echo "4. Configure secrets engines"
+echo "========================================="