{"id":20155905,"url":"https://github.com/bruj0/vault-kv-backup","last_synced_at":"2025-04-09T22:20:33.482Z","repository":{"id":51338373,"uuid":"223979677","full_name":"bruj0/vault-kv-backup","owner":"bruj0","description":"Unofficial HashiCorp Vault utility that backups a KV backend and other configuration, encrypting it via the transit secret engine","archived":false,"fork":false,"pushed_at":"2021-05-14T13:54:05.000Z","size":28,"stargazers_count":4,"open_issues_count":0,"forks_count":3,"subscribers_count":1,"default_branch":"master","last_synced_at":"2025-03-24T00:11:46.416Z","etag":null,"topics":["backup","encryption","hashicorp","hashicorp-vault","python-3","vault"],"latest_commit_sha":null,"homepage":null,"language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/bruj0.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2019-11-25T15:22:17.000Z","updated_at":"2024-08-12T19:55:11.000Z","dependencies_parsed_at":"2022-09-24T20:00:49.293Z","dependency_job_id":null,"html_url":"https://github.com/bruj0/vault-kv-backup","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/bruj0%2Fvault-kv-backup","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/bruj0%2Fvault-kv-backup/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/bruj0%2Fvault-kv-backup/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/bruj0%2Fvault-kv-backup/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/bruj0","download_url":"https://codeload.github.com/bruj0/vault-kv-backup/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248119974,"owners_count":21050865,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["backup","encryption","hashicorp","hashicorp-vault","python-3","vault"],"created_at":"2024-11-13T23:36:34.178Z","updated_at":"2025-04-09T22:20:33.463Z","avatar_url":"https://github.com/bruj0.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Disclaimer\nThis is not an official HashiCorp tool and its currently in POC stage\n\n# What is it\nIts an utility to backup the contents of a KV-v2 secret engine from a HashiCorp Vault using its **Transit secret engine**\n\n![Transit engine](https://d33wubrfki0l68.cloudfront.net/cdaa6b27e251650a51c48cfe22fd860335196fc2/999b0/static/img/vault-encryption.png)\n\nThe idea is that we can move the data in json format while being encrypted at rest with a key stored in a different location.\n\nMore information on how the Transit secrent engine works: https://learn.hashicorp.com/vault/encryption-as-a-service/eaas-transit\n\n# How to use it\n\n## Clone this repository\n```\n$ git clone https://github.com/bruj0/vault-kv-backup.git\n```\n## Optional: Use the provided docker-compose to start Vault\n```\n$ cd .docker\n$ docker-compose up -d\n$ export VAULT_ADDR=\"http://127.0.0.1:8300\"\n$ vault operator init -key-shares=1 -key-threshold=1\n$ vault operator unseal \u003cunseal key\u003e\n```\nSave the unseal keys and root token for later use.\n\nIt is configured to use a filesystem storage in the directory `.docker/data` and the configuration from `.docker/config/vault.hcl`\n\n## Enable the transit engine in Vault\n\n```\n$ vault secrets enable transit\n$ vault write -f transit/keys/backup\n```\n\n## Set the environment variables\n\n```\n$ export VAULT_ADDR=\"http://127.0.0.1:8300\"\n$ export VAULT_TOKEN=\u003cyour token\u003e\n```\n## Run the application\nThis will read the env. variables and write the encrypted data to `encrypted.json`.\n```c\n$ vmb --debug encrypted.json\n2021-05-14 09:43:51,299 [Main][INFO] (vmb.main:14)\nStarting vmb 0.0.1\n\n2021-05-14 09:43:51,300 [Main][INFO] (vmb.main:28)\nTrying to login with Token\n\n2021-05-14 09:43:51,300 [Main][DEBUG] (vmb.main:29)\nDebug enabled\n\n2021-05-14 09:43:51,319 [Transit encryption][INFO] (vmb.transit:19)\nStarting transit encryption with key=backup mount=transit\n\n2021-05-14 09:43:51,320 [KV Store][INFO] (vmb.kvstore:18)\nGetting KV data from mount=kv\n\n2021-05-14 09:43:51,321 [KV Store][INFO] (vmb.kvstore:32)\nGetting secrets for mount: kv\n\n2021-05-14 09:43:51,329 [KV Store][DEBUG] (vmb.kvstore:59)\nFound a folder: kv/\n\n2021-05-14 09:43:51,337 [KV Store][DEBUG] (vmb.kvstore:59)\nFound a folder: kv/a/\n\n2021-05-14 09:43:51,343 [KV Store][DEBUG] (vmb.kvstore:92)\nFound an entity dict_keys(['c']) with\n\n2021-05-14 09:43:51,351 [Transit encryption][DEBUG] (vmb.transit:39)\nEncrypted response:\n{'request_id': '751fd033-c512-184f-c43c-83e845d6af06', 'lease_id': '', 'renewable': False, 'lease_duration': 0, 'data': {'ciphertext': 'vault:v1:PUr6Qcs+GBOVMzv1yZRyJ0qcoSZM3+XBbiMKkKZn9RLMOIDOlb7DmQFlcUXSj1oYJUF1x6DUedz6PfgXsLhYnFdtGLTTGWfNec5E', 'key_version': 1}, 'wrap_info': None, 'warnings': None, 'auth': None}\n\n2021-05-14 09:43:51,356 [KV Store][DEBUG] (vmb.kvstore:92)\nFound an entity dict_keys(['e']) with\n\n2021-05-14 09:43:51,362 [Transit encryption][DEBUG] (vmb.transit:39)\nEncrypted response:\n{'request_id': '62a2d048-6326-5ca8-54d2-8ff88b0a4e1e', 'lease_id': '', 'renewable': False, 'lease_duration': 0, 'data': {'ciphertext': 'vault:v1:tfhB2aCyhMhCSpDa2uHwrFM26pOAfDPRy0o1fpsu+/kDMTUw5Co9gbkuYEOTs9v7MQjxZfpUE/NsHZPhRRYpJKwbCWQG1eH5dA==', 'key_version': 1}, 'wrap_info': None, 'warnings': None, 'auth': None}\n\n2021-05-14 09:43:51,364 [Main][INFO] (vmb.main:45)\nFinished encrypting and writting data to encrypted.json\n\n2021-05-14 09:43:51,384 [Main][INFO] (vmb.main:49)\nFinished encrypting and writting data to backup.key\n\n```\n\nThis will give you 2 things:\n1. A file in json with all the encrypted key-\u003evalue text, ie:\n\n```json\n{\n  \"a/\": {\n    \"b\": \"vault:v1:qzQ9JnPuiRK8rs2mWVeABa1MnrI113tVlws/ez0UyXblaXG7byMqH8SySSg06uglJ9NwyTz3KJAMlDxXHNYFgRWwCW6uwrdjA8LY\"\n  },\n  \"d\": \"vault:v1:dct+5E/xQv51XDdkZpPtQHXdEFZmjKmZacTaqm+YLiTQghzufzj0wb9ggOanaFGeDKq2gx2CA+KN30xe/4qgY4559aQv43qteA==\"\n}\n```\n1. The Transit key used as returned by the `export` API: https://www.vaultproject.io/api/secret/transit/index.html#export-key and can be used to restore it.\n\nThe idea is to keep the data encrypted and the key in different physical places in case one is breached.\n\n### TODO\n* Automation of included Vault instance\n* Restoring\n* Packaging to pypi\n* Configuration\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fbruj0%2Fvault-kv-backup","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fbruj0%2Fvault-kv-backup","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fbruj0%2Fvault-kv-backup/lists"}