{"id":15705299,"url":"https://github.com/brahmlower/vault-appauth-test","last_synced_at":"2025-10-05T20:41:27.533Z","repository":{"id":86081711,"uuid":"162093041","full_name":"brahmlower/vault-appauth-test","owner":"brahmlower","description":"Testing vault appauth with a basic python flask app","archived":false,"fork":false,"pushed_at":"2018-12-17T08:20:17.000Z","size":8,"stargazers_count":1,"open_issues_count":0,"forks_count":0,"subscribers_count":2,"default_branch":"master","last_synced_at":"2025-02-05T17:12:15.083Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/brahmlower.png","metadata":{"files":{"readme":"readme.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2018-12-17T07:43:31.000Z","updated_at":"2022-06-16T05:09:54.000Z","dependencies_parsed_at":null,"dependency_job_id":"1fd75c48-5365-46c6-baf9-c99a789ab9ed","html_url":"https://github.com/brahmlower/vault-appauth-test","commit_stats":{"total_commits":3,"total_committers":1,"mean_commits":3.0,"dds":0.0,"last_synced_commit":"d3743a62913e9468d0f82dadec1c0f65edcec1a5"},"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/brahmlower%2Fvault-appauth-test","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/brahmlower%2Fvault-appauth-test/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/brahmlower%2Fvault-appauth-test/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/brahmlower%2Fvault-appauth-test/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/brahmlower","download_url":"https://codeload.github.com/brahmlower/vault-appauth-test/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":246336545,"owners_count":20761068,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-10-03T20:15:22.250Z","updated_at":"2025-10-05T20:41:22.480Z","avatar_url":"https://github.com/brahmlower.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"\n# Vault Test\n\nThe intent of this project was to familiarize myself with Hashicorps Vault, and\nhow it's appauth mechanism can be used for a custom service, refered to in this\ncontext as \"app\". This project had several goals:\n\n- Minimise password/token use outside the app\n\n    We want to reduce the possible attack surface with regard to secrets. All\n    application related secrets should be stored within vault. We only want to\n    store temporary secrets if possible. It's common to store secrets in\n    environment variables and secured config files, but these have various short\n    comings, so we'd like to minimise the use of these methods.\n- Minimise custom scripting needed at the CI/CD layer\n\n    There is no formal CI/CD system built into this project (docker-compose\n    doesn't count in this case). The CD system would be responsible for rendering\n    the application config file, which is were the temporary auth token is\n    generated. Since the token is valid for only about 1 minute, a token would\n    need to be generated each time the container starts up. How containers are\n    started may vary significantly depending on infrastructure, so we shouldn't\n    assume we can run much logic before starting the container.\n- Make it easy to add more passwords to app in the future\n\n    For instance, I might want to implement caching with redis at a later date,\n    which would require another set of credentials. I should be able to add that\n    password without having to make major changes to the configuration system\n    (both in source code, and in code infrastructure)\n\n## Setup\n\nRequired utilities:\n\n- docker\n- docker-compose\n- pip\n- jq\n- mustache\n- vault\n\n### Database\n\nBefore testing the application and pulling secrets from vault, we need to set up\nthe database, whose password we'll be storing in vault, as well as the vault\nserver itself.\n\nBring the database up, apply the migrations and verify you can connect with the\naccount set in the docker compose file.\n\n```\n$ docker-compose up -d db\n$ PGPASSWORD=acKQfbU9PmKKsWu9 psql -U app-user -h localhost app-db \u003c sql/schema.sql\n$ PGPASSWORD=acKQfbU9PmKKsWu9 psql -U app-user -h localhost app-db \u003c sql/data.sql\n```\n\n### Vault\n\nStart the server and grab the root key for initial setup. Once started, you can\nlog into the web interface at `http://localhost:8200` with the root token.\n\n```\n$ docker-compose up -d vault\n$ export VAULT_TOKEN=$(docker-compose logs vault | grep 'Root Token:' | awk '{print $NF}')\n$ echo $VAULT_TOKEN\ns.29aVhedp1lhasRKB5bmoNWXS\n```\n\nCreate a key-value secret to store app passwords in, create a policy allowing\nread access to the new secret.\n\n```\n$ export VAULT_ADDR=http://localhost:8200/\n$ vault kv put secret/app database_password=acKQfbU9PmKKsWu9\n$ vault policy write app vault/app.hcl\n```\n\nEnable approle authentication, create a new role for our application (configured\nwith short token lifespans), and create a policy for generating login tokens for\nthe new role.\n\n```\n$ vault auth enable approle\n$ vault write auth/approle/role/app secret_id_ttl=1m token_ttl=1m token_max_tll=1m policies=\"app\"\n$ vault write sys/policy/ar-token-create policy=@vault/ar-token-create.hcl\n```\n\n### Application startup\n\nBuild the image for the app:\n\n```\n$ docker-compose build app\n```\n\nThe approle authentication is handled within the `render-auth.sh` script, which\ngets the role_id for the \"app\" role, then gets a new token for the role (requires\nhaving the `VAULT_TOKEN` environment variable set). A json object is manually\nbuilt with these two values, and passed to `mustache`, which templates them into\nthe `app/settings.yml.mustache` file. This script creates the `app/settings.yml`\nfile.\n\nOnce the app settings file is rendered, we can start the app container.\n\n```\n$ ./render-auth.sh\n$ docker-compose up app\n```\n\nThe api for the app is at `http://localhost:8000`, which in this case is really\nonly useful for confirming the whole stack is working.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fbrahmlower%2Fvault-appauth-test","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fbrahmlower%2Fvault-appauth-test","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fbrahmlower%2Fvault-appauth-test/lists"}