{"id":37148339,"url":"https://github.com/d3one/vault-backup-automation","last_synced_at":"2026-01-14T17:31:11.098Z","repository":{"id":37441542,"uuid":"505797708","full_name":"D3One/Vault-backup-automation","owner":"D3One","description":"Routine backup operation automation for HashiCorp Vault","archived":false,"fork":false,"pushed_at":"2025-08-31T07:31:09.000Z","size":29,"stargazers_count":2,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-08-31T09:18:44.481Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/D3One.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2022-06-21T10:37:06.000Z","updated_at":"2025-08-31T07:31:13.000Z","dependencies_parsed_at":"2022-08-19T05:20:07.300Z","dependency_job_id":null,"html_url":"https://github.com/D3One/Vault-backup-automation","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/D3One/Vault-backup-automation","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/D3One%2FVault-backup-automation","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/D3One%2FVault-backup-automation/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/D3One%2FVault-backup-automation/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/D3One%2FVault-backup-automation/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/D3One","download_url":"https://codeload.github.com/D3One/Vault-backup-automation/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/D3One%2FVault-backup-automation/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":28428182,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-01-14T16:38:47.836Z","status":"ssl_error","status_checked_at":"2026-01-14T16:34:59.695Z","response_time":107,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.5:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2026-01-14T17:31:10.503Z","updated_at":"2026-01-14T17:31:11.093Z","avatar_url":"https://github.com/D3One.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"\n# Vault Backup Automation\n\n[![GitHub](https://img.shields.io/badge/GitHub-D3One-blue?style=flat\u0026logo=github)](https://github.com/D3One)\n![Shell Script](https://img.shields.io/badge/Shell_Script-%23121011.svg?style=flat\u0026logo=gnu-bash\u0026logoColor=white)\n\nA robust shell script for automating encrypted backups of HashiCorp Vault's configuration and data. Designed for reliability and to be integrated into cron jobs or CI/CD pipelines.\n\n\u003cimg width=\"1024\" height=\"1024\" alt=\"image\" src=\"https://github.com/user-attachments/assets/5447a758-4c63-4e06-a38c-47d85d81be1b\" /\u003e\n\n## ⚠️ Disclaimer / Warning\n\n**WARNING! USE AT YOUR OWN RISK!**\nThis script interacts directly with your HashiCorp Vault instance, a critical security component. Incorrect use can lead to:\n* Data loss if backups are corrupted or overwritten.\n* Service interruption if Vault commands are executed improperly.\n* Exposure of sensitive data if encryption or file permissions are misconfigured.\n\n**It is strongly recommended to:**\n1. **TEST** this script thoroughly in a development or staging environment that closely mirrors your production setup.\n2. **VERIFY** your backups regularly by performing test restores.\n3. **SECURE** your backup directory and encryption keys with strict file permissions.\n4. **UNDERSTAND** what the script does before deploying it in production.\n\nThe author is not responsible for any data loss, security breaches, or downtime caused by the use of this script.\n\n---\n\n## 📖 Overview\n\nThis script provides a simple yet powerful way to create consistent snapshots of your HashiCorp Vault deployment. It handles:\n1. **Snapshot Creation:** Uses the Vault CLI to generate a snapshot of the Vault's data and configuration.\n2. **Encryption:** Optionally encrypts the snapshot file using GPG for security at rest.\n3. **Rotation:** Manages backup rotation to prevent unlimited disk space consumption.\n4. **Logging:** Provides detailed logging for auditing and troubleshooting.\n\n## 🚀 Features\n\n*   **Full Snapshot:** Captures both the Vault's storage backend and configuration.\n*   **GPG Encryption:** Secures the backup file using GnuPG (optional but recommended).\n*   **Backup Rotation:** Automatically removes old backups based on a configurable retention policy.\n*   **Comprehensive Logging:** Outputs success and error messages with timestamps for easy monitoring.\n*   **Pre-flight Checks:** Validates that the Vault CLI is installed, authenticated, and available.\n\n---\n\n## 📁 Script Functionality: `vault_backup.sh`\n\nThe main script performs the following steps:\n\n1.  **Initialization:** Sets up variables for backup directory, retention period, log file, and optional GPG recipient.\n2.  **Pre-flight Checks:**\n    *   Checks if the `vault` binary is available.\n    *   Checks if the user is authenticated with Vault (`vault token lookup`).\n    *   Creates the backup directory if it doesn't exist.\n3.  **Snapshot Creation:** Executes `vault operator raft snapshot save` to generate the snapshot file.\n4.  **Encryption (Optional):** If a GPG recipient is configured, encrypts the snapshot file for that key, leaving only the encrypted `.gpg` file and removing the plaintext snapshot.\n5.  **Rotation:** Deletes backups older than the specified number of days, keeping only the most recent ones.\n6.  **Logging \u0026 Cleanup:** Logs the outcome of each step and ensures no sensitive temporary files are left behind.\n\n---\n\n## 🛠️ Prerequisites\n\n*   **HashiCorp Vault:** A running Vault cluster (version 1.4+ for reliable Raft snapshot support).\n*   **Vault CLI:** Installed and authenticated on the machine running the script.\n    *   The CLI must have the appropriate permissions (a token with a policy granting the `sys/storage/raft/snapshot` capability).\n*   **GnuPG (Optional):** Required only if you want to encrypt the backups. The public key of the recipient must be in the keyring of the user running the script.\n\n---\n\n## 📝 Usage\n\n### 1. Clone the Repository\n```bash\ngit clone https://github.com/D3One/Vault-backup-automation.git\ncd Vault-backup-automation\n```\n\n### 2. Configure the Script\nEdit the variables at the top of the `vault_backup.sh` script to match your environment.\n\n```bash\n#!/bin/bash\n\n# --- Configuration ---\nBACKUP_DIR=\"/opt/vault/backups\"  # Where to store backups\nRETENTION_DAYS=7                 # Number of days to keep backups\nLOG_FILE=\"/var/log/vault_backup.log\" # Log file path\nTIMESTAMP=$(date +\"%Y%m%d_%H%M%S\") # Timestamp for filename\nGPG_RECIPIENT=\"user@example.com\" # Email of GPG key recipient for encryption (comment out to disable)\n# ---------------------\n```\n\n### 3. Make the Script Executable\n```bash\nchmod +x vault_backup.sh\n```\n\n### 4. Run the Script Manually\n```bash\n# Test run (ensure your VAULT_TOKEN or other auth method is set)\n./vault_backup.sh\n```\n\n### 5. Automate with Cron\nAdd a line to your crontab (e.g., `crontab -e`) to run the backup daily at 2 AM.\n\n```bash\n# Example: Run every day at 2 AM\n0 2 * * * /bin/bash /path/to/Vault-backup-automation/vault_backup.sh \u003e /dev/null 2\u003e\u00261\n\n# Example: Run and capture output to a separate log (recommended)\n0 2 * * * /bin/bash /path/to/Vault-backup-automation/vault_backup.sh \u003e\u003e /var/log/vault_cron.log 2\u003e\u00261\n```\n\n---\n\n## 🔒 Encryption\n\nFor maximum security, it is highly recommended to use GPG encryption.\n\n1.  **Import the Public Key:** Ensure the public key of the backup recipient is in the keyring of the user running the cron job.\n    ```bash\n    sudo -u vault-user gpg --import recipient-public-key.asc\n    ```\n2.  **Configure the Script:** Set the `GPG_RECIPIENT` variable in the script to the recipient's email address.\n3.  **How it works:** The script will create the snapshot, encrypt it for the specified recipient, and then securely delete the original plaintext file, leaving only the `.gpg` file.\n\n**To decrypt and restore a backup:**\n```bash\ngpg --decrypt /opt/vault/backups/vault-backup-20231027_020000.snapshot.gpg \u003e vault-restore.snapshot\nvault operator raft snapshot restore vault-restore.snapshot\n```\n\n---\n\n## 🗂️ Sample Backup File Structure\n\n```\n/opt/vault/backups/\n├── vault-backup-20231027_020000.snapshot.gpg\n├── vault-backup-20231026_020000.snapshot.gpg\n├── vault-backup-20231025_020000.snapshot.gpg\n└── vault_backup.log\n```\n\n---\n\n## 👨‍💻 Authorship\n\n*   **Author:** D3One\n*   **GitHub:** [https://github.com/D3One](https://github.com/D3One)\n*   **Repository:** [https://github.com/D3One/Vault-backup-automation](https://github.com/D3One/Vault-backup-automation)\n\nContributions, issues, and feature requests are welcome! Feel free to check the issues page or submit a pull request.\n\n---\n\n## 📜 License\n\nThis project is distributed under the MIT License. See the `LICENSE` file for more information.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fd3one%2Fvault-backup-automation","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fd3one%2Fvault-backup-automation","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fd3one%2Fvault-backup-automation/lists"}