Integrate AWX 24.6 with HashiCorp Vault for dynamic secrets management and secure automation workflows

#!/usr/bin/env bash
set -euo pipefail

# AWX 24.6 + HashiCorp Vault Integration Install Script
# Production-ready installation with multi-distro support

# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
NC='\033[0m' # No Color

# Default values
VAULT_ADDR=${1:-"127.0.0.1"}
VAULT_PORT=${2:-"8200"}
DB_HOST=${3:-"localhost"}
DB_NAME=${4:-"awx"}
DB_USER=${5:-"awx"}

# Usage message
usage() {
    echo "Usage: $0 [VAULT_ADDR] [VAULT_PORT] [DB_HOST] [DB_NAME] [DB_USER]"
    echo "Example: $0 127.0.0.1 8200 localhost awx awx"
    exit 1
}

# Logging functions
log_info() { echo -e "${BLUE}[INFO]${NC} $1"; }
log_success() { echo -e "${GREEN}[SUCCESS]${NC} $1"; }
log_warning() { echo -e "${YELLOW}[WARNING]${NC} $1"; }
log_error() { echo -e "${RED}[ERROR]${NC} $1"; }

# Error handling
cleanup() {
    if [ $? -ne 0 ]; then
        log_error "Installation failed. Cleaning up..."
        systemctl stop vault 2>/dev/null || true
        systemctl disable vault 2>/dev/null || true
        rm -f /etc/vault.d/vault.hcl 2>/dev/null || true
    fi
}
trap cleanup ERR

# Check if running as root or with sudo
check_privileges() {
    if [[ $EUID -ne 0 ]]; then
        log_error "This script must be run as root or with sudo"
        exit 1
    fi
}

# Detect distribution and set package manager
detect_distro() {
    if [ ! -f /etc/os-release ]; then
        log_error "/etc/os-release not found. Cannot detect distribution."
        exit 1
    fi
    
    . /etc/os-release
    case "$ID" in
        ubuntu|debian)
            PKG_MGR="apt"
            PKG_INSTALL="apt install -y"
            PKG_UPDATE="apt update"
            DISTRO_FAMILY="debian"
            ;;
        almalinux|rocky|centos|rhel|ol|fedora)
            PKG_MGR="dnf"
            PKG_INSTALL="dnf install -y"
            PKG_UPDATE="dnf makecache"
            DISTRO_FAMILY="rhel"
            # Fallback to yum if dnf not available
            if ! command -v dnf &> /dev/null; then
                PKG_MGR="yum"
                PKG_INSTALL="yum install -y"
                PKG_UPDATE="yum makecache"
            fi
            ;;
        amzn)
            PKG_MGR="yum"
            PKG_INSTALL="yum install -y"
            PKG_UPDATE="yum makecache"
            DISTRO_FAMILY="rhel"
            ;;
        *)
            log_error "Unsupported distribution: $ID"
            exit 1
            ;;
    esac
    
    log_info "Detected distribution: $ID ($DISTRO_FAMILY family)"
}

# Install HashiCorp Vault
install_vault() {
    log_info "[1/8] Installing HashiCorp Vault..."
    
    if [ "$DISTRO_FAMILY" = "debian" ]; then
        curl -fsSL https://apt.releases.hashicorp.com/gpg | gpg --dearmor -o /usr/share/keyrings/hashicorp-archive-keyring.gpg
        echo "deb [signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" > /etc/apt/sources.list.d/hashicorp.list
        $PKG_UPDATE
        $PKG_INSTALL vault
    else
        $PKG_INSTALL dnf-plugins-core 2>/dev/null || $PKG_INSTALL yum-utils
        if [ "$PKG_MGR" = "dnf" ]; then
            dnf config-manager --add-repo https://rpm.releases.hashicorp.com/RHEL/hashicorp.repo
        else
            yum-config-manager --add-repo https://rpm.releases.hashicorp.com/RHEL/hashicorp.repo
        fi
        $PKG_INSTALL vault
    fi
    
    log_success "Vault installed successfully"
}

# Configure Vault
configure_vault() {
    log_info "[2/8] Configuring Vault server..."
    
    # Create vault user if not exists
    if ! id vault &>/dev/null; then
        useradd -r -d /opt/vault -s /bin/false vault
    fi
    
    # Create directories
    mkdir -p /opt/vault/data /etc/vault.d
    chown -R vault:vault /opt/vault
    chmod 750 /opt/vault/data
    
    # Create Vault configuration
    cat > /etc/vault.d/vault.hcl << EOF
storage "file" {
  path = "/opt/vault/data"
}

listener "tcp" {
  address     = "0.0.0.0:${VAULT_PORT}"
  tls_disable = 1
}

api_addr = "http://${VAULT_ADDR}:${VAULT_PORT}"
cluster_addr = "https://${VAULT_ADDR}:8201"
ui = true
disable_mlock = true
EOF
    
    chown vault:vault /etc/vault.d/vault.hcl
    chmod 640 /etc/vault.d/vault.hcl
    
    # Create systemd service
    cat > /etc/systemd/system/vault.service << EOF
[Unit]
Description=HashiCorp Vault
Documentation=https://www.vaultproject.io/docs/
Requires=network-online.target
After=network-online.target
ConditionFileNotEmpty=/etc/vault.d/vault.hcl

[Service]
Type=notify
User=vault
Group=vault
ProtectSystem=full
ProtectHome=read-only
PrivateTmp=yes
PrivateDevices=yes
SecureBits=keep-caps
AmbientCapabilities=CAP_IPC_LOCK
NoNewPrivileges=yes
ExecStart=/usr/bin/vault server -config=/etc/vault.d/vault.hcl
ExecReload=/bin/kill -HUP $MAINPID
KillMode=process
Restart=on-failure
RestartSec=5
TimeoutStopSec=30
StartLimitBurst=3
LimitNOFILE=65536
LimitMEMLOCK=infinity

[Install]
WantedBy=multi-user.target
EOF
    
    log_success "Vault configured successfully"
}

# Start Vault service
start_vault() {
    log_info "[3/8] Starting Vault service..."
    
    systemctl daemon-reload
    systemctl enable vault
    systemctl start vault
    
    # Wait for Vault to start
    sleep 5
    
    if systemctl is-active --quiet vault; then
        log_success "Vault service started successfully"
    else
        log_error "Failed to start Vault service"
        systemctl status vault
        exit 1
    fi
}

# Initialize Vault
initialize_vault() {
    log_info "[4/8] Initializing Vault..."
    
    export VAULT_ADDR="http://${VAULT_ADDR}:${VAULT_PORT}"
    
    # Wait for Vault API to be ready
    for i in {1..30}; do
        if vault status &>/dev/null; then
            break
        fi
        sleep 2
    done
    
    # Check if already initialized
    if vault status | grep -q "Initialized.*true"; then
        log_warning "Vault is already initialized"
        return
    fi
    
    # Initialize Vault
    INIT_OUTPUT=$(vault operator init -key-shares=5 -key-threshold=3 -format=json)
    
    # Save keys and token securely
    UNSEAL_KEYS=$(echo "$INIT_OUTPUT" | jq -r '.unseal_keys_b64[]')
    ROOT_TOKEN=$(echo "$INIT_OUTPUT" | jq -r '.root_token')
    
    # Create secure file for keys
    cat > /etc/vault.d/vault-keys << EOF
# Vault Initialization Data - KEEP SECURE
ROOT_TOKEN=$ROOT_TOKEN
UNSEAL_KEYS=$(echo "$UNSEAL_KEYS" | tr '\n' ',' | sed 's/,$//')
EOF
    
    chown vault:vault /etc/vault.d/vault-keys
    chmod 600 /etc/vault.d/vault-keys
    
    log_success "Vault initialized successfully"
    log_warning "Keys saved to /etc/vault.d/vault-keys - KEEP THIS FILE SECURE!"
}

# Unseal Vault and configure
unseal_and_configure() {
    log_info "[5/8] Unsealing Vault and enabling engines..."
    
    export VAULT_ADDR="http://${VAULT_ADDR}:${VAULT_PORT}"
    
    # Source the keys
    . /etc/vault.d/vault-keys
    
    # Unseal Vault with first 3 keys
    IFS=',' read -ra KEYS <<< "$UNSEAL_KEYS"
    for i in {0..2}; do
        vault operator unseal "${KEYS[$i]}"
    done
    
    # Authenticate with root token
    vault auth "$ROOT_TOKEN"
    
    # Enable database secrets engine
    vault secrets enable database 2>/dev/null || log_warning "Database engine already enabled"
    
    # Enable KV v2 secrets engine
    vault secrets enable -path=secret kv-v2 2>/dev/null || log_warning "KV engine already enabled"
    
    log_success "Vault unsealed and engines enabled"
}

# Configure database connection
configure_database() {
    log_info "[6/8] Configuring database connection..."
    
    read -p "Enter database admin username: " -r DB_ADMIN_USER
    read -s -p "Enter database admin password: " -r DB_ADMIN_PASS
    echo
    
    # Configure PostgreSQL connection
    vault write database/config/postgresql-db \
        plugin_name=postgresql-database-plugin \
        connection_url="postgresql://{{username}}:{{password}}@${DB_HOST}:5432/${DB_NAME}?sslmode=disable" \
        allowed_roles="awx-role" \
        username="$DB_ADMIN_USER" \
        password="$DB_ADMIN_PASS"
    
    # Create AWX role
    vault write database/roles/awx-role \
        db_name=postgresql-db \
        creation_statements="CREATE ROLE \"{{name}}\" WITH LOGIN PASSWORD '{{password}}' VALID UNTIL '{{expiration}}'; GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO \"{{name}}\";" \
        default_ttl="1h" \
        max_ttl="24h"
    
    log_success "Database connection configured"
}

# Create AWX policy and token
create_awx_policy() {
    log_info "[7/8] Creating AWX policy and token..."
    
    # Create AWX policy
    cat > /tmp/awx-policy.hcl << EOF
path "database/creds/awx-role" {
  capabilities = ["read"]
}

path "secret/data/awx/*" {
  capabilities = ["read", "list"]
}

path "auth/token/lookup-self" {
  capabilities = ["read"]
}

path "auth/token/renew-self" {
  capabilities = ["update"]
}
EOF
    
    vault policy write awx-policy /tmp/awx-policy.hcl
    rm -f /tmp/awx-policy.hcl
    
    # Create token for AWX
    AWX_TOKEN=$(vault token create -policy=awx-policy -ttl=8760h -format=json | jq -r '.auth.client_token')
    
    # Save AWX token securely
    echo "AWX_VAULT_TOKEN=$AWX_TOKEN" >> /etc/vault.d/vault-keys
    
    log_success "AWX policy and token created"
}

# Verification
verify_installation() {
    log_info "[8/8] Verifying installation..."
    
    # Check Vault status
    if ! vault status | grep -q "Sealed.*false"; then
        log_error "Vault is not unsealed"
        exit 1
    fi
    
    # Test database credentials generation
    if ! vault read database/creds/awx-role &>/dev/null; then
        log_error "Cannot generate database credentials"
        exit 1
    fi
    
    # Test KV engine
    vault kv put secret/awx/test key=value
    if ! vault kv get secret/awx/test | grep -q "value"; then
        log_error "KV engine test failed"
        exit 1
    fi
    vault kv delete secret/awx/test
    
    log_success "Installation verified successfully"
    echo
    log_info "Vault is running on http://${VAULT_ADDR}:${VAULT_PORT}"
    log_info "Configuration files: /etc/vault.d/"
    log_info "Data directory: /opt/vault/data"
    log_warning "Keep /etc/vault.d/vault-keys file secure - it contains root token!"
}

# Main execution
main() {
    check_privileges
    detect_distro
    
    install_vault
    configure_vault
    start_vault
    initialize_vault
    unseal_and_configure
    configure_database
    create_awx_policy
    verify_installation
    
    log_success "AWX-Vault integration installation completed successfully!"
}

# Validate arguments
if [[ $# -gt 5 ]]; then
    usage
fi

main "$@"