sudo apt-get update && sudo apt-get install -y gnupg software-properties-common
wget -O- https://apt.releases.hashicorp.com/gpg | \
    gpg --dearmor | \
    sudo tee /usr/share/keyrings/hashicorp-archive-keyring.gpg
gpg --no-default-keyring \
    --keyring /usr/share/keyrings/hashicorp-archive-keyring.gpg \
    --fingerprint
echo "deb [signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] \
    https://apt.releases.hashicorp.com $(lsb_release -cs) main" | \
    sudo tee /etc/apt/sources.list.d/hashicorp.list
sudo apt update
sudo apt-get install terraform

terraform init -backend-config=”backend-dev.config”
terraform plan -var-file="parentvarvalues.tfvars"
terraform apply -var-file="parentvarvalues-team1.tfvars" -auto-approve

terraform init && terraform validate
terraform fmt
terraform plan -out=planned.tfstate
terraform apply planned.tfstate
terraform console
> module.vault_kms_autoseal.vault_kms_key_id
KMSKID
> module.vault_kms_autoseal.aws_iam_access_key_secret_id
AKID
> module.vault_kms_autoseal.aws_iam_access_key_secret
(sensitive)
> exit

# Installation
dnf install -y nginx iptables certbot python3-certbot-nginx yum-utils
systemctl enable --now nginx
certbot certonly --rsa-key-size 4096 --email kuk@kuk.com --nginx -d lichnak.cz -d www.lichnak.cz -d vault.lichnak.cz -d blog.lichnak.cz

echo "vault soft nofile 65536" >> /etc/security/limits.conf
echo "vault hard nofile 65536" >> /etc/security/limits.conf
echo "vault soft memlock infinity" >> /etc/security/limits.conf
echo "vault hard memlock infinity" >> /etc/security/limits.conf
sysctl -p
sysctl -w fs.file-max=12000500
sysctl -w fs.nr_open=20000500
ulimit -n 20000000
sysctl -w net.ipv4.tcp_rmem='1024 4096 16384'
sysctl -w net.ipv4.tcp_wmem='1024 4096 16384'
sysctl -w net.core.rmem_max=16384

yum-config-manager --add-repo https://rpm.releases.hashicorp.com/RHEL/hashicorp.repo
dnf -y install vault
cat >/usr/lib/systemd/system/vault.service <<"EOF"
[Unit]
Description="HashiCorp Vault - A tool for managing secrets"
Documentation=https://www.vaultproject.io/docs/
Requires=network-online.target
After=network-online.target
ConditionFileNotEmpty=/etc/vault.d/vault.hcl
StartLimitIntervalSec=60
StartLimitBurst=3

[Service]
Type=notify
EnvironmentFile=/etc/vault.d/vault.env
User=vault
Group=vault
ProtectSystem=full
ProtectHome=read-only
PrivateTmp=yes
PrivateDevices=yes
SecureBits=keep-caps
AmbientCapabilities=CAP_IPC_LOCK
CapabilityBoundingSet=CAP_SYSLOG CAP_IPC_LOCK
NoNewPrivileges=yes
ExecStart=/usr/bin/vault server -config=/etc/vault.d/vault.hcl
ExecReload=/bin/kill --signal HUP $MAINPID
KillMode=process
KillSignal=SIGINT
Restart=on-failure
RestartSec=15
TimeoutStopSec=30
LimitNOFILE=65536
LimitMEMLOCK=infinity

[Install]
WantedBy=multi-user.target
EOF
cat > /etc/vault.d/vault.env <<"EOF"
VAULT_SKIP_VERIFY=true
EOF
cat > /etc/vault.d/vault.hcl <<"EOF"
# Full configuration options can be found at https://www.vaultproject.io/docs/configuration

ui = true

# relates to https://docs.nginx.com/nginx/admin-guide/load-balancer/using-proxy-protocol/#proxy_protocol

#proxy_protocol_behavior = use_always

#mlock = true
disable_mlock = true

#storage "file" {
#  path = "/opt/vault/data"
#}

storage "raft" {
 path = "/opt/vault/data"
 node_id = "raft_01"
}

#storage "consul" {
#  address = "127.0.0.1:8500"
#  path    = "vault"
#}

# HTTP listener
#listener "tcp" {
#  address = "127.0.0.1:8200"
#  tls_disable = 1
#}

# HTTPS listener
#listener "tcp" {
#  address       = "0.0.0.0:8200"
#  tls_cert_file = "/opt/vault/tls/tls.crt"
#  tls_key_file  = "/opt/vault/tls/tls.key"
#}

listener "tcp" {
  address       = "127.0.0.1:8200"
  tls_cert_file = "/opt/vault/tls/fullchain.pem"
  tls_key_file  = "/opt/vault/tls/privkey.pem"
}

cluster_addr = "https://127.0.0.1:8201"
api_addr = "https://127.0.0.1:8200"
#api_addr = "https://vault.lichnak.cz"

#license_path = "/etc/vault.d/vault.hclic"

# Example AWS KMS auto unseal
seal "awskms" {
  region = "eu-central-1"
  kms_key_id = "kmskid"
}

# Example HSM auto unseal
#seal "pkcs11" {
#  lib            = "/usr/vault/lib/libCryptoki2_64.so"
#  slot           = "0"
#  pin            = "AAAA-BBBB-CCCC-DDDD"
#  key_label      = "vault-hsm-key"
#  hmac_key_label = "vault-hsm-hmac-key"
#}
EOF
cat /opt/vault/tls/tls.crt
cat <<"EOF" | sudo tee /etc/systemd/system/vault.service.d/override.conf > /dev/null
[Service]
Environment="AWS_ACCESS_KEY_ID=AKID"
Environment="AWS_SECRET_ACCESS_KEY=ASAK"
Environment="AWS_REGION=eu-central-1"
EOF
vault -version
vault -autocomplete-install
whereis vault
complete -C /usr/bin/vault vault

#with symbolic link you will need more adjuments
ln -s /etc/letsencrypt/live/lichnak.cz/fullchain.pem /opt/vault/tls/fullchain.pem
ln -s /etc/letsencrypt/live/lichnak.cz/privkey.pem /opt/vault/tls/privkey.pem

#or you can simply copy certs
cp /etc/letsencrypt/live/lichnak.cz/privkey.pem /opt/vault/tls/privkey.pem
cp /etc/letsencrypt/live/lichnak.cz/fullchain.pem /opt/vault/tls/fullchain.pem

chown -R vault:vault /opt/vault/tls/
systemctl enable --now vault
export VAULT_SKIP_VERIFY=true
export VAULT_ADDR="https://127.0.0.1:8200"
vault operator init -key-shares=1 -key-threshold=1

cat > /etc/nginx/sites-available/vault.lichnak.cz.conf <<"EOF"
upstream vault {
  server 127.0.0.1:8200 fail_timeout=0;
}

server {
  server_name vault.lichnak.cz;
  access_log /var/log/nginx/vhost/vault.lichnak.cz-access.log;
  error_log /var/log/nginx/vhost/vault.lichnak.cz-error.log;

  location / {
    proxy_read_timeout 300;
    proxy_connect_timeout 300;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Host $host;
    proxy_set_header X-Forwarded-Server $host;
    proxy_set_header Host $host;
    proxy_set_header X-NginX-Proxy true;
    proxy_set_header X-Forwarded-Proto $scheme;

    proxy_pass https://vault;
    proxy_redirect off;
  }

  location /ui/ {
    proxy_read_timeout 300;
    proxy_connect_timeout 300;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Host $host;
    proxy_set_header X-Forwarded-Server $host;
    proxy_set_header Host $host;
    proxy_set_header X-NginX-Proxy true;
    proxy_set_header X-Forwarded-Proto $scheme;

    proxy_pass https://vault;
    proxy_redirect off;
  }

  location /v1/ {
    proxy_read_timeout 300;
    proxy_connect_timeout 300;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Host $host;
    proxy_set_header X-Forwarded-Server $host;
    proxy_set_header Host $host;
    proxy_set_header X-NginX-Proxy true;
    proxy_set_header X-Forwarded-Proto $scheme;

    proxy_pass https://vault;
    proxy_redirect off;
  }

    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/lichnak.cz/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/lichnak.cz/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

}

server {
    if ($host = vault.lichnak.cz) {
        return 301 https://$host$request_uri;
    } # managed by Certbot


  server_name vault.lichnak.cz;
    listen 80;
    return 404; # managed by Certbot


}
EOF
ln -s /etc/nginx/sites-available/vault.lichnak.cz.conf /etc/nginx/sites-enabled/vault.lichnak.cz.conf
nginx -t
systemctl restart nginx

# Configuration
# Basic Admins role and userpass
cat > vaultadmin-policy.hcl <<"EOF"

# Manage auth methods broadly across Vault
path "auth/*"
{
  capabilities = ["create", "read", "update", "delete", "list", "sudo"]
}

# Create, update, and delete auth methods
path "sys/auth/*"
{
  capabilities = ["create", "update", "delete", "sudo"]
}

# List auth methods
path "sys/auth"
{
  capabilities = ["read"]
}

# List existing policies via CLI
path "sys/policy"
{
  capabilities = ["read"]
}

# Create and manage ACL policies via CLI
path "sys/policy/*"
{
  capabilities = ["create", "read", "update", "delete", "list", "sudo"]
}

# Create and manage ACL policies via API
path "sys/policies/acl/*"
{
  capabilities = ["create", "read", "update", "delete", "list", "sudo"]
}

# List, create, update, and delete key/value secrets
path "secret/*"
{
  capabilities = ["create", "read", "update", "delete", "list", "sudo"]
}

# Manage secret engines broadly across Vault
path "sys/mounts/*"
{
  capabilities = ["create", "read", "update", "delete", "list", "sudo"]
}

# List existing secret engines
path "sys/mounts"
{
  capabilities = ["read"]
}

# Read health checks
path "sys/health"
{
  capabilities = ["read", "sudo"]
}

EOF

vault policy write vaultadmins vaultadmin-policy.hcl
vault auth enable userpass

vault write auth/userpass/users/lichnak \
    password=foo \
    policies=vaultadmins

# Gitlab CI/CD integration
vault auth enable jwt

vault policy write myproject-staging - <<EOF
# Policy name: myproject-staging
#
# Read-only permission on 'secret/data/myproject/staging/*' path
path "secret/data/myproject/staging/*" {
  capabilities = [ "read" ]
}
EOF

vault policy write myproject-production - <<EOF
# Policy name: myproject-production
#
# Read-only permission on 'secret/data/myproject/production/*' path
path "secret/data/myproject/production/*" {
  capabilities = [ "read" ]
}
EOF

vault write auth/jwt/role/myproject-staging - <<EOF
{
  "role_type": "jwt",
  "policies": ["myproject-staging"],
  "token_explicit_max_ttl": 60,
  "user_claim": "user_email",
  "bound_claims": {
    "project_id": "22",
    "ref": "master",
    "ref_type": "branch"
  }
}
EOF

$ vault write auth/jwt/role/myproject-production - <<EOF
{
  "role_type": "jwt",
  "policies": ["myproject-production"],
  "token_explicit_max_ttl": 60,
  "user_claim": "user_email",
  "bound_claims_type": "glob",
  "bound_claims": {
    "project_id": "22",
    "ref_protected": "true",
    "ref_type": "branch",
    "ref": "auto-deploy-*"
  }
}
EOF

vault write auth/jwt/config \
    jwks_url="https://gitlab.example.com/-/jwks" \
    bound_issuer="gitlab.example.com"

# Azure AD OAuthv2 authentication
#!/usr/bin/env bash

# flags
set -o errexit # make your script exit when a command fails
set -o pipefail # exit status of the last command that threw a non-zero exit code is returned
set -o nounset # exit when your script tries to use undeclared variables

export _CONST_SECRET_PATH="secrets"
export _CONST_AUTH_PATH="lichnakdevops"
export _CONST_GROUP_NAME="lichnakdevops"
export _CONST_POLICY_NAME="lichnakdevops"

export VAULT_ADDR="https://vault.lichak.cz"
#export VAULT_LOGIN_METHOD="ldap"
#export VAULT_LOGIN_USER="cz010377"
export VAULT_LOGIN_ROLE=${_CONST_GROUP_NAME}
export VAULT_TOKEN=<your_token>

# Vault login
#vault login -method="${VAULT_LOGIN_METHOD}" username="${VAULT_LOGIN_USER}"
vault login

# Azure cli login
az login --allow-no-subscriptions

export AD_AZURE_DISPLAY_NAME="${_CONST_GROUP_NAME}"

export AD_VAULT_APP_ID=$(az ad app create \
   --display-name ${AD_AZURE_DISPLAY_NAME} \
   --reply-urls "http://localhost:8250/oidc/callback" \
   "${VAULT_ADDR}/ui/vault/auth/${_CONST_AUTH_PATH}/oidc/callback" | \
   jq -r '.appId')

export AD_MICROSOFT_GRAPH_API_ID=$(az ad sp list \
   --filter "displayName eq 'Microsoft Graph'" \
   --query '[].appId' -o tsv)

export AD_PERMISSION_GROUP_MEMBER_READ_ALL_ID=$(az ad sp show \
   --id ${AD_MICROSOFT_GRAPH_API_ID} \
   --query "oauth2Permissions[?value=='GroupMember.Read.All'].id" -o tsv)

az ad app permission add \
   --id ${AD_VAULT_APP_ID} \
   --api ${AD_MICROSOFT_GRAPH_API_ID} \
   --api-permissions ${AD_PERMISSION_GROUP_MEMBER_READ_ALL_ID}=Scope

az ad sp create --id ${AD_VAULT_APP_ID}

az ad app permission grant --id ${AD_VAULT_APP_ID} \
    --api ${AD_MICROSOFT_GRAPH_API_ID}

export AD_TENANT_ID=$(az ad sp show --id ${AD_VAULT_APP_ID} \
   --query 'appOwnerTenantId' -o tsv)

export AD_CLIENT_SECRET=$(az ad app credential reset \
    --id ${AD_VAULT_APP_ID} | jq -r '.password')

cat > manifest.json << "EOF"
{
    "idToken": [
        {
            "name": "groups",
            "additionalProperties": []
        }
    ]
}
EOF

az ad app update --id ${AD_VAULT_APP_ID} \
    --set groupMembershipClaims=SecurityGroup \
    --optional-claims @manifest.json

cat > "${_CONST_POLICY_NAME}"-policy.hcl << "EOF"
path "${_CONST_SECRET_PATH}/*" {
    capabilities = ["create", "read", "update", "delete", "list", "sudo"]
}
EOF

vault policy write "${_CONST_POLICY_NAME}" "${_CONST_POLICY_NAME}"-policy.hcl

vault secrets enable -path="${_CONST_SECRET_PATH}" -version=2 kv

vault kv enable-versioning "${_CONST_SECRET_PATH}"/

vault auth enable -path=${_CONST_AUTH_PATH} oidc

vault write auth/${_CONST_AUTH_PATH}/config \
    oidc_client_id="${AD_VAULT_APP_ID}" \
    oidc_client_secret="${AD_CLIENT_SECRET}" \
    default_role="${VAULT_LOGIN_ROLE}" \
    oidc_discovery_url="https://login.microsoftonline.com/${AD_TENANT_ID}/v2.0"

vault write auth/f13devops/config \
    oidc_client_id="6f1f6a80-0695-4ba8-addd-651e846b4f50" \
    oidc_client_secret="${AD_CLIENT_SECRET}" \
    default_role="f13devops" \
    oidc_discovery_url="https://login.microsoftonline.com/5f58b220-c237-4744-b456-3bbab5fba4f8/v2.0"

vault write auth/${_CONST_AUTH_PATH}/role/${VAULT_LOGIN_ROLE} \
   allowed_redirect_uris="http://localhost:8250/oidc/callback" \
   allowed_redirect_uris="${VAULT_ADDR}/ui/vault/auth/${_CONST_AUTH_PATH}/oidc/callback" \
   user_claim="email" \
   groups_claim="groups" \
   policies="${_CONST_POLICY_NAME}" \
   oidc_scopes="https://graph.microsoft.com/.default"

az ad group create \
   --display-name ${AD_AZURE_DISPLAY_NAME} \
   --mail-nickname=${AD_AZURE_DISPLAY_NAME}

export AD_GROUP_ID=$(az ad group show \
   --group ${AD_AZURE_DISPLAY_NAME} \
   --query objectId -o tsv)

export VAULT_GROUP_ID=$(vault write \
   -field=id -format=table \
   identity/group \
   name="${VAULT_LOGIN_ROLE}" \
   type="external" \
   policies="${_CONST_POLICY_NAME}")

export VAULT_OIDC_ACCESSOR_ID=$(vault auth list -format=json | \
   jq -r '."${_CONST_AUTH_PATH}/".accessor')

export VAULT_GROUP_ALIAS_ID=$(vault write \
   -field=id -format=table \
   identity/group-alias \
   name="${AD_GROUP_ID}" \
   mount_accessor="${VAULT_OIDC_ACCESSOR_ID}" \
   canonical_id="${VAULT_GROUP_ID}")

vault login -method=oidc -path="${_CONST_AUTH_PATH}" role="${_CONST_GROUP_NAME}"

vault kv list "${_CONST_SECRET_PATH}"

export VAULT_ADDR="https://vault.lichnak.cz"                                                                                                            
vault login -method=oidc -path=your_path role=your_role
vault kv list secrets
vault kv get secrets/wwwmysitecz/demo
vault kv get secrets/riskmgmt/test/aad_client_credential
vault kv get secrets/riskmgmt/test/aad_client_id
vault kv get secrets/riskmgmt/test/aad_authority

# Backups
## Vault Automated bakups
# Check for automated snapshots
vault list sys/storage/raft/snapshot-auto/config

# Local
vault list sys/storage/raft/snapshot-auto/config/hourly \
interval=1h
retain=336
storage_type=local
local_max_space=1073741824 #1GiB in bytes

# AWS S3 bucket
vault list sys/storage/raft/snapshot-auto/config/hourly \
interval=1h
retain=336
storage_type=aws-s3
aws_s3_bucket=lichnak-vault-snapshot
aws_s3_regiont=eu-central-1
aws_s3_enable_kms=true
aws_s3_kms_key=00000000-0000-0000-0000-000000000000

## Vault Manual snapshots
# Vault server preparation
sudo adduser vault-snapshot #password stored in KeePass
sudo su - vault-snapshot
echo "export VAULT_ADDR=https://vault.lichnak.cz" >> .bashrc
. .bashrc
mkdir vault-snap
cd vault-snap

# Creation of policy and generation of credentials
vault login

cat <<EOF > snapshot_policy.hcl
path "/sys/storage/raft/snapshot"
{
  capabilities = ["read"]
}
EOF
vault policy write snapshot_policy snapshot_policy.hcl
vault write auth/approle/role/snapshot-role token_policies="snapshot_policy"
vault read -format=json auth/approle/role/snapshot-role/role-id > ./.role-id
vault write -format=json -f auth/approle/role/snapshot-role/secret-id > ./.secret-id

# Create create-snap.sh script
cat > create-snap.sh <<"EOF"
#!/usr/bin/env bash

# flags
#set -o errexit # make your script exit when a command fails
#set -o pipefail # exit status of the last command that threw a non-zero exit code is returned
#set -o nounset # exit when your script tries to use undeclared variables

export VAULT_ADDR=https://vault.lichnak.cz
SNAP_PATH="/home/vault-snapshot/vault-snap/"
NOW=$(date +'%Y%m%d%H%M')
SECRET_PATH="${SNAP_PATH}.secret-id"
ROLE_PATH="${SNAP_PATH}.role-id"

SECRET_ID_TOKEN=$(jq -r '.data.secret_id' ${SECRET_PATH})
ROLE_ID_TOKEN=$(jq -r '.data.role_id' ${ROLE_PATH})

#echo ${SECRET_ID_TOKEN}
#echo ${ROLE_ID_TOKEN}

throw_error () {
if [ $1 -ne 0 ]; then
        echo "${NOW} - $2"
        exit 1
fi
}

LOGIN_TOKEN=$(vault write -field=token auth/approle/login role_id=${ROLE_ID_TOKEN} secret_id=${SECRET_ID_TOKEN})
login_ret_code=$?
throw_error ${login_ret_code} "Vault login error!"

vault login ${LOGIN_TOKEN} > /dev/null
login_ret_code=$?
throw_error ${login_ret_code} "Vault login error!"

vault operator raft snapshot save ${SNAP_PATH}/vlt${NOW}.snap
snapshot_ret_code=$?
throw_error ${snapshot_ret_code} "Vault snapshot creation error!"
EOF

# Test functionality
./create-snap.sh
ll
# Crontab setup
sudo vi /etc/crontab
# /etc/crontab: system-wide crontab
# Unlike any other crontab you don't have to run the `crontab'
# command to install the new version when you edit this file
# and files in /etc/cron.d. These files also have username fields,
# that none of the other crontabs do.

SHELL=/bin/bash
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin

# Example of job definition:
# .---------------- minute (0 - 59)
# |  .------------- hour (0 - 23)
# |  |  .---------- day of month (1 - 31)
# |  |  |  .------- month (1 - 12) OR jan,feb,mar,apr ...
# |  |  |  |  .---- day of week (0 - 6) (Sunday=0 or 7) OR sun,mon,tue,wed,thu,fri,sat
# |  |  |  |  |
# *  *  *  *  * user-name command to be executed
#17 *    * * *   root    cd / && run-parts --report /etc/cron.hourly
#25 6    * * *   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily )
#47 6    * * 7   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.weekly )
#52 6    1 * *   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.monthly )

# Run snapshot script every hour
10 * * * * vault-snapshot /home/vault-snapshot/vault-snap/create-snap.sh &>> /home/vault-snapshot/vault-snap/crontab.log

# Logrotate setup
mkdir /home/vault-snapshot/vault-snap/archive/
cd /etc/logrotate.d/
sudo cat <<EOF > vault-snap
/home/vault-snapshot/vault-snap/*.snap {
        daily
        compress
        olddir /home/vault-snapshot/vault-snap/archive/
        nocreate
        maxage 60
}
EOF

# Restore

# Create secrets storage
# secret/{project_id}/{env_type}/{secret_role} → secrets/lichnakcz/dev/ssh
#Create secretes storage with KV-v2  
vault secrets enable -version=2 kv
vault kv enable-versioning secret/
vault kv put secrets/lichnakcz/dev/ssh \
  ssh-root-key=AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAArF6nttsDco8LolAOa4paErvRQp2vw4p5KzwaVkABPA=
vault kv get secrets/lichnakcz/dev/ssh
vault kv delete secrets/lichnakcz/dev/ssh
vault kv undelete secrets/lichnakcz/dev/ssh
vault kv destroy -versions=2 secrets/lichnakcz/dev/ssh
vault kv metadata get secrets/lichnakcz/dev/ssh

# Create policies
# vaultadmin policy will be applied to provide access for auth/oidc/role/dcc
# Admin Policy deployment  

cat > vaultadmin-policy.hcl <<"EOF"
# Manage auth methods broadly across Vault
path "auth/*"
{
  capabilities = ["create", "read", "update", "delete", "list", "sudo"]
}

# Create, update, and delete auth methods
path "sys/auth/*"
{
  capabilities = ["create", "update", "delete", "sudo"]
}

# List auth methods
path "sys/auth"
{
  capabilities = ["read"]
}

# List existing policies via CLI
path "sys/policy"
{
  capabilities = ["read"]
}

# Create and manage ACL policies via CLI
path "sys/policy/*"
{
  capabilities = ["create", "read", "update", "delete", "list", "sudo"]
}

# Create and manage ACL policies via API
path "sys/policies/acl/*"
{
  capabilities = ["create", "read", "update", "delete", "list", "sudo"]
}

# List, create, update, and delete key/value secrets
path "secret/*"
{
  capabilities = ["create", "read", "update", "delete", "list", "sudo"]
}

# Manage secret engines broadly across Vault
path "sys/mounts/*"
{
  capabilities = ["create", "read", "update", "delete", "list", "sudo"]
}

# List existing secret engines
path "sys/mounts"
{
  capabilities = ["read"]
}

# Read health checks
path "sys/health"
{
  capabilities = ["read", "sudo"]
}
EOF

vault policy write vaultadmin vaultadmin-policy.hcl

vault auth enable oidc
vault login -method=oidc port=8400 role=dcc
#Complete the login via your OIDC provider. Launching browser to:
#
#    https://myco.auth0.com/authorize?redirect_uri=http%3A%2F%2Flocalhost%3A8400%2Foidc%2Fcallback&client_id=r3qXc2bix9eF...

vault write auth/oidc/config \
    oidc_discovery_url="https://myco.auth0.com/" \
    oidc_client_id="m5i8bj3iofytj" \
    oidc_client_secret="f4ubv72nfiu23hnsj" \
    default_role="dcc"

# Create a named role:
vault write auth/oidc/role/dcc \
    bound_subject="r3qX9DljwFIWhsiqwFiu38209F10atW6@clients" \
    bound_audiences="https://vault.plugin.auth.jwt.test" \
    user_claim="https://vault/user" \
    groups_claim="https://vault/groups" \
    policies=vaultadmin \
    ttl=1h