ระบบจัดการ Secrets แบบ Self-Hosted

version: '3.8'

services:
  vault-db:
    image: postgres:15-alpine
    container_name: vault-db
    environment:
      - POSTGRES_USER=vault
      - POSTGRES_PASSWORD=your_strong_password_here
      - POSTGRES_DB=vault
    volumes:
      - vault_data:/var/lib/postgresql/data
      # Mount schema SQL file for automatic initialization
      - ./vault-schema.sql:/docker-entrypoint-initdb.d/init.sql:ro
    networks:
      - vault-network

volumes:
  vault_data:

networks:
  vault-network:
    driver: bridge

version: '3.8'

services:
  vault:
    image: hashicorp/vault:1.15.3
    container_name: vault
    restart: always
    cap_add:
      - IPC_LOCK
    environment:
      - VAULT_ADDR=http://0.0.0.0:8200
      - VAULT_API_ADDR=http://0.0.0.0:8200
      - VAULT_CLUSTER_ADDR=https://0.0.0.0:8201
    volumes:
      - ./vault-config:/vault/config
      - ./vault-data:/vault/data
      - ./vault-logs:/vault/logs
    ports:
      - "8200:8200"
      - "8201:8201"
      - "8202:8202"
    networks:
      - vault-network
    depends_on:
      - vault-db

networks:
  vault-network:
    external: true
    name: vault-network

storage "postgresql" {
  connection_url = "postgresql://vault:your_strong_password_here@vault-db:5432/vault?sslmode=disable"
}

listener "tcp" {
  address         = "0.0.0.0:8200"
  cluster_address = "0.0.0.0:8201"
  tls_disable     = true
}

api_addr     = "http://vault:8200"
cluster_addr = "https://0.0.0.0:8201"

ui = true

version: '3.8'

services:
  nginx:
    image: nginx:alpine
    container_name: vault-nginx
    ports:
      - "443:443"
      - "80:80"
    volumes:
      - ./nginx.conf:/etc/nginx/nginx.conf:ro
      - ./ssl:/etc/nginx/ssl:ro
    networks:
      - vault-network
    depends_on:
      - vault

networks:
  vault-network:
    external: true
    name: vault-network

events {
    worker_connections 1024;
}

http {
    # Redirect HTTP to HTTPS
    server {
        listen 80;
        server_name vault.yourcompany.com;
        return 301 https://$server_name$request_uri;
    }

    # HTTPS server
    server {
        listen 443 ssl;
        server_name vault.yourcompany.com;

        ssl_certificate /etc/nginx/ssl/cert.pem;
        ssl_certificate_key /etc/nginx/ssl/key.pem;
        ssl_protocols TLSv1.2 TLSv1.3;
        ssl_ciphers HIGH:!aNULL:!MD5;

        location / {
            proxy_pass http://vault:8200;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
        }
    }
}

stages:
  - build
  - deploy

variables:
  VAULT_ADDR: "https://vault.yourcompany.com"
  VAULT_ENGINE: "kv-v2"
  VAULT_SECRET_PATH: "gitlab/ci"

build:
  stage: build
  image: alpine:latest
  script:
    - apk add --no-cache curl jq
    - |
      # Authenticate with Vault using AppRole
      ROLE_ID=$(cat /etc/vault/role_id)
      SECRET_ID=$(cat /etc/vault/secret_id)
      
      # Get Vault token
      RESPONSE=$(curl -s -X POST "$VAULT_ADDR/v1/auth/approle/login" \
        -d "{\"role_id\":\"$ROLE_ID\",\"secret_id\":\"$SECRET_ID\"}")
      
      TOKEN=$(echo $RESPONSE | jq -r '.auth.client_token')
      
      # Read secret from Vault
      SECRET_RESPONSE=$(curl -s -H "X-Vault-Token: $TOKEN" \
        "$VAULT_ADDR/v1/$VAULT_ENGINE/data/$VAULT_SECRET_PATH")
      
      DB_PASSWORD=$(echo $SECRET_RESPONSE | jq -r '.data.data.db_password')
      API_KEY=$(echo $SECRET_RESPONSE | jq -r '.data.data.api_key')
      
      # Export as variables for next jobs
      echo "export DB_PASSWORD=$DB_PASSWORD" >> build.env
      echo "export API_KEY=$API_KEY" >> build.env
      
      # Use the secrets
      echo "✓ Database password retrieved successfully"
      echo "✓ API key retrieved successfully"
  artifacts:
    reports:
      dotenv: build.env
    expire_in: 1 hour

deploy:
  stage: deploy
  image: alpine:latest
  script:
    - apk add --no-cache curl
    - |
      echo "Deploying with secrets from Vault..."
      echo "Database host: $DB_HOST"
      echo "API endpoint: $API_ENDPOINT"
      # Deploy your application
      ./deploy.sh

#!/bin/bash
# rotate-secrets.sh

VAULT_ADDR="https://vault.yourcompany.com"
SECRET_PATH="gitlab/ci"
NEW_API_KEY=$(openssl rand -base64 32)
NEW_API_SECRET=$(openssl rand -base64 64)

# Authenticate
ROLE_ID=${VAULT_ROLE_ID:-$(cat /etc/vault/role_id)}
SECRET_ID=${VAULT_SECRET_ID:-$(cat /etc/vault/secret_id)}

RESPONSE=$(curl -s -X POST "$VAULT_ADDR/v1/auth/approle/login" \
  -d "{\"role_id\":\"$ROLE_ID\",\"secret_id\":\"$SECRET_ID\"}")
TOKEN=$(echo $RESPONSE | jq -r '.auth.client_token')

# Update secrets
curl -s -H "X-Vault-Token: $TOKEN" \
  -X POST "$VAULT_ADDR/v1/kv/data/$SECRET_PATH" \
  -d "{\"data\": {
    \"api_key\": \"$NEW_API_KEY\",
    \"api_secret\": \"$NEW_API_SECRET\"
  }}" | jq .

# Output new secrets for next pipeline
echo "NEW_API_KEY=$NEW_API_KEY" >>Rotate.env
echo "NEW_API_SECRET=$NEW_API_SECRET" >>Rotate.env

# Notify team (Slack/Email)
echo "✓ Secrets rotated successfully!"

#!/bin/bash
# export-to-vault.sh
# Script to export secrets from env vars to Vault

VAULT_ADDR="https://vault.yourcompany.com"
SECRET_PATH="migrated-secrets"

# Read from old .env file (backup first!)
source .env.backup

# Authenticate
TOKEN=$(curl -s -X POST "$VAULT_ADDR/v1/auth/approle/login" \
  -d "{\"role_id\":\"$VAULT_ROLE_ID\",\"secret_id\":\"$VAULT_SECRET_ID\"}" | jq -r '.auth.client_token')

# Export each secret
export_to_vault() {
  local name=$1
  local value=$2
  
  if [ -n "$value" ] && [ "$value" != "" ]; then
    echo "Exporting $name..."
    curl -s -H "X-Vault-Token: $TOKEN" \
      -X POST "$VAULT_ADDR/v1/kv/data/$SECRET_PATH" \
      -d "{\"data\": {\"$name\": \"$value\"}}" | jq .
  fi
}

# Export secrets
export_to_vault "db_password" "$DB_PASSWORD"
export_to_vault "db_host" "$DB_HOST"
export_to_vault "api_key" "$API_KEY"
export_to_vault "aws_access_key" "$AWS_ACCESS_KEY"

echo "✓ Migration complete!"