Configure Podman secrets management with HashiCorp Vault integration

#!/usr/bin/env bash

set -euo pipefail

# Colors for output
readonly RED='\033[0;31m'
readonly GREEN='\033[0;32m'
readonly YELLOW='\033[1;33m'
readonly NC='\033[0m'

# Script configuration
readonly SCRIPT_NAME="$(basename "$0")"
readonly VAULT_CONFIG_DIR="/etc/vault.d"
readonly VAULT_DATA_DIR="/opt/vault/data"
readonly VAULT_USER="vault"
readonly VAULT_ADDR="http://127.0.0.1:8200"

# Global variables
VAULT_UNSEAL_KEY=""
VAULT_ROOT_TOKEN=""
PKG_INSTALL=""

# Usage message
usage() {
    cat << EOF
Usage: $SCRIPT_NAME [OPTIONS]
Configure Podman secrets management with HashiCorp Vault integration

OPTIONS:
    -h, --help          Show this help message
    --vault-addr ADDR   Vault server address (default: $VAULT_ADDR)

Examples:
    $SCRIPT_NAME
    $SCRIPT_NAME --vault-addr http://10.0.0.100:8200
EOF
}

# Logging functions
log_info() { echo -e "${GREEN}[INFO]${NC} $1" >&2; }
log_warn() { echo -e "${YELLOW}[WARN]${NC} $1" >&2; }
log_error() { echo -e "${RED}[ERROR]${NC} $1" >&2; }

# Cleanup function
cleanup() {
    local exit_code=$?
    if [ $exit_code -ne 0 ]; then
        log_error "Installation failed. Cleaning up..."
        systemctl stop vault 2>/dev/null || true
        systemctl disable vault 2>/dev/null || true
        userdel "$VAULT_USER" 2>/dev/null || true
        rm -rf "$VAULT_DATA_DIR" "$VAULT_CONFIG_DIR" 2>/dev/null || true
    fi
    exit $exit_code
}

trap cleanup EXIT ERR

# Parse arguments
parse_args() {
    while [[ $# -gt 0 ]]; do
        case $1 in
            -h|--help)
                usage
                exit 0
                ;;
            --vault-addr)
                VAULT_ADDR="$2"
                shift 2
                ;;
            *)
                log_error "Unknown option: $1"
                usage
                exit 1
                ;;
        esac
    done
}

# Check prerequisites
check_prerequisites() {
    echo "[1/8] Checking prerequisites..."
    
    if [ "$EUID" -ne 0 ]; then
        log_error "This script must be run as root"
        exit 1
    fi
    
    # Detect distribution
    if [ ! -f /etc/os-release ]; then
        log_error "/etc/os-release not found. Cannot detect distribution."
        exit 1
    fi
    
    source /etc/os-release
    case "$ID" in
        ubuntu|debian)
            PKG_INSTALL="apt-get install -y"
            ;;
        almalinux|rocky|centos|rhel|ol|fedora)
            PKG_INSTALL="dnf install -y"
            command -v dnf >/dev/null 2>&1 || PKG_INSTALL="yum install -y"
            ;;
        amzn)
            PKG_INSTALL="yum install -y"
            ;;
        *)
            log_error "Unsupported distribution: $ID"
            exit 1
            ;;
    esac
    
    log_info "Detected distribution: $ID"
}

# Install HashiCorp Vault
install_vault() {
    echo "[2/8] Installing HashiCorp Vault..."
    
    case "$ID" in
        ubuntu|debian)
            wget -O- https://apt.releases.hashicorp.com/gpg | gpg --dearmor -o /usr/share/keyrings/hashicorp-archive-keyring.gpg
            echo "deb [signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" > /etc/apt/sources.list.d/hashicorp.list
            apt-get update
            $PKG_INSTALL vault
            ;;
        almalinux|rocky|centos|rhel|ol|fedora|amzn)
            if command -v dnf >/dev/null 2>&1; then
                dnf install -y dnf-plugins-core
                dnf config-manager --add-repo https://rpm.releases.hashicorp.com/RHEL/hashicorp.repo
            else
                yum install -y yum-utils
                yum-config-manager --add-repo https://rpm.releases.hashicorp.com/RHEL/hashicorp.repo
            fi
            $PKG_INSTALL vault
            ;;
    esac
    
    log_info "Vault installed successfully"
}

# Configure Vault server
configure_vault() {
    echo "[3/8] Configuring Vault server..."
    
    # Create directories and user
    mkdir -p "$VAULT_DATA_DIR" "$VAULT_CONFIG_DIR"
    useradd --system --home /opt/vault --shell /bin/false "$VAULT_USER" 2>/dev/null || true
    chown -R "$VAULT_USER:$VAULT_USER" /opt/vault
    
    # Create Vault configuration
    cat > "$VAULT_CONFIG_DIR/vault.hcl" << 'EOF'
ui = true
disable_mlock = true

storage "file" {
  path = "/opt/vault/data"
}

listener "tcp" {
  address     = "127.0.0.1:8200"
  tls_disable = 1
}

api_addr = "http://127.0.0.1:8200"
cluster_addr = "https://127.0.0.1:8201"
EOF
    
    chmod 644 "$VAULT_CONFIG_DIR/vault.hcl"
    chown root:root "$VAULT_CONFIG_DIR/vault.hcl"
    
    log_info "Vault configuration created"
}

# Create Vault systemd service
create_vault_service() {
    echo "[4/8] Creating Vault systemd service..."
    
    cat > /etc/systemd/system/vault.service << 'EOF'
[Unit]
Description=HashiCorp Vault
Documentation=https://www.vaultproject.io/docs/
Requires=network-online.target
After=network-online.target
ConditionFileNotEmpty=/etc/vault.d/vault.hcl
StartLimitIntervalSec=60
StartLimitBurst=3

[Service]
Type=notify
User=vault
Group=vault
ProtectSystem=full
ProtectHome=read-only
PrivateTmp=yes
PrivateDevices=yes
SecureBits=keep-caps
AmbientCapabilities=CAP_IPC_LOCK
Capabilities=CAP_IPC_LOCK+ep
CapabilityBoundingSet=CAP_SYSLOG CAP_IPC_LOCK
NoNewPrivileges=yes
ExecStart=/usr/bin/vault server -config=/etc/vault.d/vault.hcl
ExecReload=/bin/kill --signal HUP $MAINPID
KillMode=process
Restart=on-failure
RestartSec=5
TimeoutStopSec=30
StartLimitInterval=60
StartLimitBurst=3
LimitNOFILE=65536
LimitMEMLOCK=infinity

[Install]
WantedBy=multi-user.target
EOF
    
    systemctl daemon-reload
    systemctl enable vault
    systemctl start vault
    
    # Wait for Vault to start
    sleep 5
    
    log_info "Vault service created and started"
}

# Initialize and unseal Vault
initialize_vault() {
    echo "[5/8] Initializing and unsealing Vault..."
    
    export VAULT_ADDR="$VAULT_ADDR"
    
    # Initialize Vault
    local init_output
    init_output=$(vault operator init -key-shares=1 -key-threshold=1 -format=json)
    
    VAULT_UNSEAL_KEY=$(echo "$init_output" | grep -o '"unseal_keys_b64":\["[^"]*"' | cut -d'"' -f4)
    VAULT_ROOT_TOKEN=$(echo "$init_output" | grep -o '"root_token":"[^"]*"' | cut -d'"' -f4)
    
    # Unseal Vault
    vault operator unseal "$VAULT_UNSEAL_KEY"
    
    export VAULT_TOKEN="$VAULT_ROOT_TOKEN"
    
    log_info "Vault initialized and unsealed"
    log_warn "IMPORTANT: Save these credentials securely!"
    echo "Unseal Key: $VAULT_UNSEAL_KEY"
    echo "Root Token: $VAULT_ROOT_TOKEN"
}

# Configure KV secrets engine
configure_kv_secrets() {
    echo "[6/8] Configuring KV secrets engine..."
    
    export VAULT_ADDR="$VAULT_ADDR"
    export VAULT_TOKEN="$VAULT_ROOT_TOKEN"
    
    vault secrets enable -path=secret kv-v2
    
    log_info "KV secrets engine enabled"
}

# Install Podman
install_podman() {
    echo "[7/8] Installing Podman..."
    
    case "$ID" in
        ubuntu|debian)
            $PKG_INSTALL podman
            ;;
        almalinux|rocky|centos|rhel|ol|fedora|amzn)
            $PKG_INSTALL podman
            ;;
    esac
    
    log_info "Podman installed successfully"
}

# Verify installation
verify_installation() {
    echo "[8/8] Verifying installation..."
    
    # Check Vault status
    if systemctl is-active --quiet vault; then
        log_info "✓ Vault service is running"
    else
        log_error "✗ Vault service is not running"
        return 1
    fi
    
    # Check Vault API
    export VAULT_ADDR="$VAULT_ADDR"
    export VAULT_TOKEN="$VAULT_ROOT_TOKEN"
    
    if vault status >/dev/null 2>&1; then
        log_info "✓ Vault API is accessible"
    else
        log_error "✗ Vault API is not accessible"
        return 1
    fi
    
    # Check Podman
    if command -v podman >/dev/null 2>&1; then
        log_info "✓ Podman is installed"
    else
        log_error "✗ Podman is not installed"
        return 1
    fi
    
    log_info "Installation completed successfully!"
    echo
    echo "Next steps:"
    echo "1. Export VAULT_ADDR=$VAULT_ADDR"
    echo "2. Export VAULT_TOKEN=$VAULT_ROOT_TOKEN"
    echo "3. Create secrets with: vault kv put secret/myapp username=admin password=secret"
    echo "4. Configure Podman containers to use Vault secrets"
}

# Main function
main() {
    parse_args "$@"
    check_prerequisites
    install_vault
    configure_vault
    create_vault_service
    initialize_vault
    configure_kv_secrets
    install_podman
    verify_installation
}

main "$@"