Vault Deployment Guide with Integrated Storage

First, export some environment variables to specify the Vault download base URL and preferred Vault version for convenience and concise commands. Then use curl to download the package and SHA256 summary files.

$ export VAULT_URL="https://releases.hashicorp.com/vault" \
         VAULT_VERSION="1.4.0"
$ curl \
      --silent \
      --remote-name \
     "${VAULT_URL}/${VAULT_VERSION}/vault_${VAULT_VERSION}_linux_amd64.zip"

$ curl \
      --silent \
      --remote-name \
      "${VAULT_URL}/${VAULT_VERSION}/vault_${VAULT_VERSION}_SHA256SUMS"

$ curl \
      --silent \
      --remote-name \
      "${VAULT_URL}/${VAULT_VERSION}/${VAULT_VERSION}/vault_${VAULT_VERSION}_SHA256SUMS.sig"

You should now have the 3 files present locally:

$ ls -1
vault_1.4.0_SHA256SUMS
vault_1.4.0_SHA256SUMS.sig
vault_1.4.0_linux_amd64.zip

Unzip the downloaded package, move the vault binary to /usr/local/bin/, and check that vault is available on the system path.

$ unzip vault_${VAULT_VERSION}_linux_amd64.zip
$ sudo chown root:root vault
$ sudo mv vault /usr/local/bin/
$ vault -version
Vault v1.4.0+ent

The vault command features opt-in autocompletion for flags, subcommands, and arguments (where supported).

$ vault -autocomplete-install
$ complete -C /usr/local/bin/vault vault

Give vault the ability to use the mlock syscall without running the process as root. The mlock syscall prevents memory from being swapped to disk.

$ sudo setcap cap_ipc_lock=+ep /usr/local/bin/vault

Create a unique, non-privileged system user to run vault.

$ sudo useradd --system --home /etc/vault.d --shell /bin/false vault

Create a configuration file at /etc/vault.d/vault.hcl:

$ sudo mkdir --parents /etc/vault.d
$ sudo touch /etc/vault.d/vault.hcl
$ sudo chown --recursive vault:vault /etc/vault.d
$ sudo chmod 640 /etc/vault.d/vault.hcl

listener "tcp" {
  address       = "0.0.0.0:8200"
  tls_cert_file = "/path/to/fullchain.pem"
  tls_key_file  = "/path/to/privkey.pem"
}

seal "pkcs11" {
  lib            = "/usr/vault/lib/libCryptoki2_64.so"
  slot           = "0"
  pin            = "AAAA-BBBB-CCCC-DDDD"
  key_label      = "vault-hsm-key"
  hmac_key_label = "vault-hsm-hmac-key"
}

It is recommended that this directory be created as follows:

$ sudo mkdir /opt/raft
$ sudo chown -R vault:vault /opt/raft

Add the below configuration to the /etc/vault.d/vault.hcl file:

storage "raft" {
  path = "/opt/raft"
  node_id = "raft_node_1"
}

»Configure systemd

Systemd uses documented defaults so only non-default values must be set in the configuration file.

Create a Vault service file at /etc/systemd/system/vault.service.

$ sudo touch /etc/systemd/system/vault.service

Add the below configuration to the Vault service file:

[Unit]
Description="HashiCorp Vault - A tool for managing secrets"
Documentation=https://www.vaultproject.io/docs/
Requires=network-online.target
After=network-online.target
ConditionFileNotEmpty=/etc/vault.d/vault.hcl
StartLimitIntervalSec=60
StartLimitBurst=3

[Service]
User=vault
Group=vault
ProtectSystem=full
ProtectHome=read-only
PrivateTmp=yes
PrivateDevices=yes
SecureBits=keep-caps
AmbientCapabilities=CAP_IPC_LOCK
Capabilities=CAP_IPC_LOCK+ep
CapabilityBoundingSet=CAP_SYSLOG CAP_IPC_LOCK
NoNewPrivileges=yes
ExecStart=/usr/local/bin/vault server -config=/etc/vault.d/vault.hcl
ExecReload=/bin/kill --signal HUP $MAINPID
KillMode=process
KillSignal=SIGINT
Restart=on-failure
RestartSec=5
TimeoutStopSec=30
LimitNOFILE=65536
LimitMEMLOCK=infinity

[Install]
WantedBy=multi-user.target

The following parameters are set for the [Unit] stanza:

• Description - Free-form string describing the vault service
• Documentation - Link to the vault documentation
• Requires - Configure a requirement dependency on the network service
• After - Configure an ordering dependency on the network service being started before the vault service
• ConditionFileNotEmpty - Check for a non-zero sized configuration file before vault is started
• StartLimitIntervalSec, StartLimitBurst - Limit vault to three start attempts in 60 seconds (support for systemd version 230+)

The following parameters are set for the [Service] stanza:

• User, Group - Run vault as the vault user
• ProtectSystem, ProtectHome, PrivateTmp, PrivateDevices - Sandboxing settings to improve the security of the host by restricting vault privileges and access
• SecureBits, Capabilities, CapabilityBoundingSet, AmbientCapabilities - Configure the capabilities of the vault process (support for multiple systemd versions)
• NoNewPrivileges - Prevent vault and any child process from gaining new privileges
• ExecStart - Start vault with the server argument and path to the configuration file
• ExecReload - Send vault a HUP signal to trigger a configuration reload in vault
• KillMode - Treat vault as a single process
• KillSignal - Send SIGINT signal when shutting down vault
• Restart - Restart vault (in a sealed state) unless it returned a clean exit code
• RestartSec - Restart vault after 5 seconds of it being considered 'failed'
• TimeoutStopSec - Wait 30 seconds for a clean stop before sending a SIGKILL signal
• LimitNOFILE, LimitMEMLOCK - Limit the number of file descriptors to the configured value and prevent memory being swapped to disk

The following parameters are set for the [Install] stanza:

• WantedBy - Creates a weak dependency on vault being started by the multi-user run level

Enable and start Vault using the systemctl command responsible for controlling systemd managed services. Check the status of the vault service using systemctl.

$ sudo systemctl enable vault
$ sudo systemctl start vault
$ sudo systemctl status vault