1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35

[Unit]
Description="HashiCorp Vault - A tool for managing secrets"
Documentation=https://www.vaultproject.io/docs/
Requires=network-online.target
After=network-online.target
ConditionFileNotEmpty=/opt/vault/data/config/vault.hcl
StartLimitIntervalSec=60
StartLimitBurst=3

[Service]
Type=notify
User=root
Group=root
ProtectSystem=full
ProtectHome=read-only
PrivateTmp=yes
PrivateDevices=yes
SecureBits=keep-caps
AmbientCapabilities=CAP_IPC_LOCK
CapabilityBoundingSet=CAP_SYSLOG CAP_IPC_LOCK
NoNewPrivileges=yes
ExecStart=/usr/bin/vault server -config=/opt/vault/data/config/vault.hcl
StandardOutput=file:/var/log/vault/vault.log
StandardError=file:/var/log/vault/vault.log
ExecReload=/bin/kill --signal HUP $MAINPID
KillMode=process
KillSignal=SIGINT
Restart=on-failure
RestartSec=5
TimeoutStopSec=30
LimitNOFILE=65536
LimitMEMLOCK=infinity

[Install]
WantedBy=multi-user.target

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47

ui               = true
disable_mlock    = true
disable_sealwrap = true
 
cluster_name = "pawpaw-vault-cluster"
api_addr     = "https://pawpaw-vault01.com:8200"
cluster_addr = "https://pawpaw-vault01.com:8201"

# info, trace, debug, info, warn, err
log_level    = "info"
log_format   = "json"
log_file     = "/var/log/vault/vault.log"

# license_path = "/opt/vault/data/license/vault.hclic" # enterprise 指定 license 的位置

listener "tcp" {
  address            = "[::]:8200"
  tls_cert_file      = "/opt/vault/data/certs/host.crt"
  tls_client_ca_file = "/opt/vault/data/certs/rootCA.crt"
  tls_key_file       = "/opt/vault/data/certs/host.key"
  # 設定不使用 tls
  # tls_disable        = "true" 
}

storage "raft" {
  # 每個node皆不同名稱
  node_id = "vault1" 
  path    = "/opt/vault/data/raft"
  # node1 下面需要設定 node2 和 node3, node2 需要設定 node1 和 node3, node3 須設定 node1 和 node2
  retry_join {
    leader_api_addr         = "https://pawpaw-vault02.com:8200"
    leader_ca_cert_file     = "/opt/vault/data/certs/rootCA.crt"
    leader_client_cert_file = "/opt/vault/data/certs/host.crt"
    leader_client_key_file  = "/opt/vault/data/certs/host.key"
  }
  retry_join {
    leader_api_addr         = "https://pawpaw-vault03.com:8200"
    leader_ca_cert_file     = "/opt/vault/data/certs/rootCA.crt"
    leader_client_cert_file = "/opt/vault/data/certs/host.crt"
    leader_client_key_file  = "/opt/vault/data/certs/host.key"
  }
}

telemetry {
  disable_hostname          = true
  prometheus_retention_time = "12h"
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

/var/log/vault/vault_audit.log {
   daily              # 每日 rotate log file
   rotate 180         # 保留180個舊 log file
   notifempty         # 如果 log file 沒有內容則不進行 rotate
   missingok          # 如果 log file 不存在則忽略錯誤
   compress           # 壓縮 rotate 後的 log file 
   delaycompress      # 延遲到下次 rotate 時再壓縮 log file
   copytruncate       # 複製並截斷原始文件
   postrotate         # 在 log file rotate 之後執行以下命令
     /bin/systemctl reload vault 2> /dev/null || true # 重新載入vault服務, 忽略錯誤
   endscript          # postrotate腳本結束
   dateext            # 在 rotate 的 log file 名稱中加入日期
   dateformat -%Y%m%d # 使用指定的日期格式為日誌檔案命名, 格式為：-YYYYMMDD
}

/var/log/vault/vault.log {
   daily              # 每日 rotate log file
   rotate 180         # 保留180個舊 log file
   notifempty         # 如果 log file 沒有內容則不進行 rotate
   missingok          # 如果 log file 不存在則忽略錯誤
   compress           # 壓縮 rotate 後的 log file 
   delaycompress      # 延遲到下次 rotate 時再壓縮 log file
   copytruncate       # 複製並截斷原始文件
   postrotate         # 在 log file rotate 之後執行以下命令
     /bin/systemctl reload vault 2> /dev/null || true # 重新載入vault服務, 忽略錯誤
   endscript          # postrotate腳本結束
   dateext            # 在 rotate 的 log file 名稱中加入日期
   dateformat -%Y%m%d # 使用指定的日期格式為日誌檔案命名, 格式為：-YYYYMMDD
}