Vault - vault.hcl (server configuration)

#------------------------------------------------------------------------------
# File: vault.hcl
# Description: Hashicorp Vault configuration
# Author: admin01
# Date: 2023
#
# REF-1: https://developer.hashicorp.com/vault/docs/configuration
# REF-2: https://developer.hashicorp.com/vault/docs/configuration/listener/tcp
# REF-3: https://developer.hashicorp.com/vault/docs/configuration/storage/raft
# REF-4: https://developer.hashicorp.com/vault/docs/configuration/seal/transit
#------------------------------------------------------------------------------

#------------------------------------------------------------------------------
# Basic configuration
#------------------------------------------------------------------------------
# Specifies the identifier for the Vault cluster.
cluster_name = "prod-vault"

# Specifies the address to advertise to other Vault servers in the cluster for
# request forwarding.
cluster_addr  = "https://prod-vault-node1.example.net:8201"

# Specifies the address (full URL) to advertise to other Vault servers in the
# cluster for client redirection.
# With load balancer    - api_addr = FQDN of the LoadBalancer
# Without load balancer - api_addr = FQDN of the Vault node
api_addr      = "https://prod-vault.example.net:8200"

# Enabling GUI
ui = "true"

# Disabling mlock is strongly recommended if using integrated storage due to the
# fact that mlock does not interact well with memory mapped files such as those
# created by BoltDB, which is used by Raft to track state.
disable_mlock = "true"

# Disabling all caches within Vault, including the read cache used by the physical
# storage subsystem.
disable_cache = "true"

# Default and max lease duration for tokens and secrets
max_lease_ttl = "10h"
default_lease_ttl = "10h"

# Enables the sys/raw endpoint which allows the decryption/encryption of raw data
# into and out of the security barrier.
raw_storage_endpoint = "true"

# Disabling using seal wrapping for any value except the master key. If this
# value is toggled, the new behavior will happen lazily (as values are read or written).
# (Vault Enterprise parameter)
disable_sealwrap = "true"

# ?
disable_printable_check = "true"

#------------------------------------------------------------------------------
# Network configuration
#------------------------------------------------------------------------------
# Listener on the loopback interface - for administration purposes only.
listener "tcp" {
  # Specifies the address to bind to for listening.
  address    = "127.0.0.1:8200"

  # Disabling TLS
  tls_disable = "true"
}

# Configuration of the listener on the IP address of the Vault node.
listener "tcp" {
  # Specifies the address to bind to for listening.
  address    = "10.10.1.34:8200"

  # Specifies the address to bind to for cluster server-to-server requests.
  cluster_address = "10.10.1.34:8201"

  # Specifies the path to the certificate for TLS. It requires a PEM-encoded file.
  tls_cert_file      = "/opt/vault/tls/prod-vault-node1.example.net-cert.pem"

  # Specifies the path to the private key for the certificate. It requires a PEM-encoded file.
  # If the key file is encrypted, you will be prompted to enter the passphrase on server startup.
  tls_key_file       = "/opt/vault/tls/prod-vault-node1.example.net-key.pem"

  # PEM-encoded Certificate Authority file used for checking the authenticity of client.
  tls_client_ca_file = "/opt/vault/tls/prod-vault-node1.example.net-ca.pem"

  # Turns off client authentication for this listener.
  tls_disable_client_certs = "true"

  # Min and Max version of the TLS (TLS hardening)
  tls_min_version = "tls13"
  tls_max_version = "tls13"
}

#------------------------------------------------------------------------------
# Storage configuration
#------------------------------------------------------------------------------

storage "raft" {
  # The file system path where all the Vault data gets stored.
  path    = "/data"

  # The identifier for the node in the Raft cluster.
  node_id = "prod-vault-node1.example.net"

  # Enable verification of TLS certificates.
  tls_skip_verify = "false"

  retry_join {
    # The TLS server name to use when connecting with HTTPS. Should match one
    # of the names in the DNS SANs of the remote server certificate.
    leader_tls_servername   = "prod-vault-node1.example.net"

    # Address of a possible leader node.
    leader_api_addr         = "https://prod-vault-node1.example.net:8200"
  }

  retry_join {
    leader_tls_servername   = "prod-vault-node2.example.net"
    leader_api_addr         = "https://prod-vault-node2.example.net:8200"
  }

  retry_join {
    leader_tls_servername   = "prod-vault-node3.example.net"
    leader_api_addr         = "https://prod-vault-node3.example.net:8200"
  }

  retry_join {
    leader_tls_servername   = "prod-vault-node4.example.net"
    leader_api_addr         = "https://prod-vault-node4.example.net:8200"
  }

  retry_join {
    leader_tls_servername   = "prod-vault-node5.example.net"
    leader_api_addr         = "https://prod-vault-node5.example.net:8200"
  }
}

#------------------------------------------------------------------------------
# Seal configuration
#------------------------------------------------------------------------------
seal "transit" {
  # The full address to the Vault cluster.
  address = "https://common-vault.example.net:443"

  # The Vault token to use
  token = "<TRANSIT_UNSEAL_TOKEN>"

  # Disables the automatic renewal of the token in case the lifecycle of the
  # token is managed with some other mechanism outside of Vault, such as Vault
  # Agent.
  disable_renewal = "false"

  # The transit key to use for encryption and decryption.
  key_name = "autounseal-prod-vault"

  # The mount path to the transit secret engine.
  mount_path = "transit/"

  # Enable verification of TLS certificates.
  tls_skip_verify = "false"

  # Set this to true if Vault is migrating from an auto seal configuration.
  disabled = "false"
}