# Vault Bootstrap

## 1. Deploy

```bash
helm repo add hashicorp https://helm.releases.hashicorp.com
helm upgrade --install vault hashicorp/vault \
  --namespace vault \
  --create-namespace \
  -f vendor/platform/vault/values.yaml

kubectl -n vault apply -f vendor/platform/vault/network-policies.yaml
kubectl -n vault wait --for=condition=Ready pod/vault-0 --timeout=120s
```

## 2. Initialize

```bash
kubectl -n vault exec vault-0 -- vault operator init \
  -key-shares=5 \
  -key-threshold=3 \
  -format=json > ./vendor/platform/vault/.secrets/vault-init.json
```

## 3. Unseal

```bash
for pod in vault-0 vault-1 vault-2; do
  jq -r '.unseal_keys_b64[:3][]' ./vendor/platform/vault/.secrets/vault-init.json | xargs -I{} \
    kubectl -n vault exec "$pod" -- vault operator unseal {}
done
```

This same procedure is required after every cluster restart.

## 4. Terraform (PKI + auth methods + policies)

```bash
kubectl -n vault port-forward svc/vault 8200:8200

export VAULT_ADDR=http://127.0.0.1:8200
export VAULT_TOKEN=$(jq -r '.root_token' ./vendor/platform/vault/.secrets/vault-init.json)
export DOMAIN_NAME='some domain name'
export ADMIN_USER='some admin user'

cd terraform/internal/vault
../../scripts/tofu-versitygw-state init
../../scripts/tofu-versitygw-state apply \
  -var="internal_domain=${DOMAIN_NAME}" \
  -var="users=[\"${ADMIN_USER}\"]" \
  -var="admin_user=${ADMIN_USER}"

../../scripts/tofu-versitygw-state output -json user_passwords
```

Required existing secret: `secret/cloudflare/api-token` key `api-token`.

## 5. Revoke root token

```bash
vault login -method=userpass username=${ADMIN_USER}
vault token revoke $(jq -r '.root_token' ./vendor/platform/vault/.secrets/vault-init.json)
```

## 6. Set up Vault Secrets Operator

```bash
helm upgrade --install -n vault \
    vault-secrets-operator \
    hashicorp/vault-secrets-operator \
    -f vendor/platform/vault/vso-values.yaml
```