#!/bin/bash if [[ -f /opt/vault/tls/tls.crt ]] && [[ -f /opt/vault/tls/tls.key ]]; then echo "Vault TLS key and certificate already exist. Exiting." exit 0 fi echo "Generating Vault TLS key and self-signed certificate..." # Create TLS and Data directory mkdir --parents /opt/vault/tls mkdir --parents /opt/vault/data # Generate TLS key and certificate cd /opt/vault/tls openssl req \ -out tls.crt \ -new \ -keyout tls.key \ -newkey rsa:4096 \ -nodes \ -sha256 \ -x509 \ -subj "/O=HashiCorp/CN=Vault" \ -days 1095 # 3 years # Update file permissions chown --recursive vault:vault /etc/vault.d chown --recursive vault:vault /opt/vault chmod 600 /opt/vault/tls/tls.crt /opt/vault/tls/tls.key chmod 700 /opt/vault/tls echo "Vault TLS key and self-signed certificate have been generated in '/opt/vault/tls'." # Set IPC_LOCK capabilities on vault setcap cap_ipc_lock=+ep /usr/bin/vault if [ -d /run/systemd/system ]; then systemctl --system daemon-reload >/dev/null || true fi if [[ $(vault version) == *+ent* ]]; then echo " The following shall apply unless your organization has a separately signed Enterprise License Agreement or Evaluation Agreement governing your use of the software: Software in this repository is subject to the license terms located in the software, copies of which are also available at https://eula.hashicorp.com/ClickThruELA-Global.pdf or https://www.hashicorp.com/terms-of-evaluation as applicable. Please read the license terms prior to using the software. Your installation and use of the software constitutes your acceptance of these terms. If you do not accept the terms, do not use the software. " fi