🏗️ Architektura Vault

Architektura logiczna

Obiekty w HashiCorp Vault Cluster

Sekrety używane podczas bootstrap

Vault KV v2: dev.rachuna/infrastructure/vault-rachuna-dev/ansible/
└── vip_authentication_pass (Keepalived auth)

User SSH keys:

Vault KV v2: users/
├── mrachuna/ssh (public key)
└── auth/ssh/techuser (technical user SSH key)

---

Relacje repozytoriów i zależności

ansible/requirements.yml

Plik gdzie są zdefiniowane zależności Ansible. Zawiera:

9 external roles (pobierane z gitlab.com/dev.rachuna/artifacts/ansible-roles/):

• set-timezone, users-management, sudo, set-hostname, ssh-hardening, install-packages, keepalived, haproxy, certificates

2 local roles (zdefiniowane w tym repozytorium):

• install-vault — instalacja i konfiguracja HashiCorp Vault
• vault-auto-unseal — systemd service do automatycznego unseal’u Vault

iac-vault/main.tf.json + submodules

Plik główny z modułami OpenTofu. Struktura:

modules/
├── kv                    — Secret Engines (KV v2)
├── users                 — Userpass user accounts (używa external shared module)
├── auth                  — Auth methods (userpass, approle)
├── audit                 — File audit logging
└── pki                   — PKI hierarchy + roles + certs

iac-vault/providers.tf

Konfiguracja providera Vault:

• Terraform/OpenTofu: Wymagana nowoczesna wersja
• Vault provider: hashicorp/vault
• Default address: https://vault-1006.rachuna.dev:8200 (można zmienić zmienną vault_address)
• TLS verification: Wyłączona w dev (wymaga włączenia w production)

---

⚠️ Słabe strony

Auto-unseal — niesecure w current implementation

Caution

⚠️ Homelab-only risk — w production trzeba Transit seal lub cloud KMS

Rekomendacja: Migracja na Vault Transit Seal (self-hosted) lub AWS KMS/Google Cloud KMS.

---

📁 Struktura repozytorium

vault-rachuna-dev/                     (parent — this directory)
├── gitlab-profile/                    (project documentation) 
│   └── README.md                
│
├── ansible/                           (Ansible provisioning)
│   ├── README.md
│   ├── requirements.yml               (external roles + versions)
│   ├── inventory/
│   │   ├── hosts.yml                  (vault-1005, vault-1006, vault-1007)
│   │   ├── group_vars/vault/          (shared variables)
│   │   └── host_vars/                 (per-host overrides)
│   ├── playbooks/
│   │   ├── install.yml                (main provisioning playbook)
│   │   └── test_connection.yml
│   └── playbooks/roles/               (3 local roles)
│       ├── install-vault/
│       └── vault-auto-unseal/
│
└── iac-vault/                          (OpenTofu/Terraform IaC for Vault)
    ├── README.md
    ├── providers.tf / providers.tf.json
    ├── main.tf / main.tf.json          (root modules)
    ├── variables.tf / variables.tf.json
    ├── kv/                             (KV secret engines)
    ├── auth/                           (auth methods)
    ├── approles/                       (AppRole definitions)
    ├── users/                          (userpass users)
    ├── policies/                       (ACL policies — 26 files)
    ├── pki/                            (PKI hierarchy + certs)
    ├── audit/                          (audit logging)
    └── tools/                          (helper scripts)
        ├── create-user-account.sh
        ├── tofu-init.sh
        └── tofu-plan.sh

---

Topologia fizyczna

Stos serwisów na każdym węźle

Serwis	Port	Rola	Config
Keepalived	VRRP	VIP failover (10.3.1.254)	FQDN-based health check na :8200
HAProxy	443 (HTTPS)	Load balancer, SNI routing	Frontendz: vault DNS names
Vault	8200 (HTTP), 8201 (cluster)	Secrets + PKI engine	Storage: RAFT, TLS enabled

Routing SNI (HAProxy)

Client → vault.rachuna.dev:443
  ↓
HAProxy :443 (TCP mode, SNI-aware)
  └─ SNI: vault.rachuna.dev → localhost:8200 (Vault)

Parametry Keepalived

• Virtual IP: 10.3.1.254/24 na eth0
• VRRP instance: VAULT_VIP, virtual_router_id 254
• Health check: 5s interval, HTTP GET https://127.0.0.1:8200/v1/sys/health?standbyok=true&sealedcode=503
• Advert interval: 1s
• Failover: prioritety: 200 (MASTER vault-1005) → 120 (MASTER vault-1006) → 110 (BACKUP vault-1007)