Vault

## HashiCorp Vault Secrets Management System **Official Website:** https://www.vaultproject.io/ **Repository:** https://github.com/lazycatapps/vault.git **Quick Start Guide:** https://github.com/lazycatapps/vault/blob/main/QUICKSTART.md HashiCorp Vault is a powerful secrets management tool for securely storing and accessing secrets, passwords, certificates, API keys, and other sensitive information. Vault provides a unified interface to access any secret while providing strict access control and detailed audit logs. This application provides a complete Vault server environment, supporting Web UI and API access, suitable for development and testing environments. ## Access URL After installation, the application can be accessed via: `https://vault.{box-name}.heiyu.space` ## Main Features - 🔐 Securely store sensitive information (passwords, API keys, certificates, etc.) - 📝 Key-Value secrets engine with version control - 🔄 Dynamic secrets generation (databases, cloud services, etc.) - 🔑 Multiple authentication methods (Token, LDAP, GitHub, etc.) - 📊 Detailed audit logging - 🌐 RESTful API and command-line tools - 🎨 Intuitive Web user interface - 🔒 Data encryption and access control policies ## First-time Usage Instructions (Important) **Note: Vault requires initialization and unsealing operations on first startup. This is an important part of Vault's security mechanism!** ### Initialize via Web UI (Recommended) 1. Access the application's Web interface 2. Click the "Initialize" button 3. Configure the number of key shares and unseal threshold 4. Click "Initialize" to complete initialization 5. **Important: Immediately download or copy all Unseal Keys and Root Token! This information cannot be recovered if lost!** 6. Use the required number of Unseal Keys to unseal Vault sequentially 7. Login to the system using the Root Token ## Usage Instructions ### Web UI Operations 1. Login using Root Token or other authentication methods 2. Enable required secrets engines (e.g., KV v2) 3. Create and manage secrets 4. Configure access policies and authentication methods 5. View audit logs ## Security Considerations - 🔑 **Unseal Keys Management**: Store Unseal Keys separately in secure locations. The configured threshold number of Keys is required to unseal Vault - 🎫 **Root Token Protection**: Root Token has full privileges. Keep it secure and consider using other authentication methods for daily use - 🔒 **Production Configuration**: Current configuration disables TLS and is only suitable for development and testing. Production environments must enable TLS encryption - 💾 **Data Backup**: Regularly backup Vault data and configuration to ensure secrets are not lost - 📝 **Audit Logs**: It's recommended to enable audit logging to record all access activities ## Common Issues ### Vault is in sealed state Vault automatically enters sealed state after each restart and needs to be unsealed. Please access the Web UI and enter the required number of Unseal Keys to unseal. ### Forgot Root Token If you forget the Root Token, you can generate a new Root Token using Unseal Keys. Please refer to the official Vault documentation for specific instructions.