Set up Vault as a PKI certificate authority with SSL automation and intermediate CA

#!/usr/bin/env bash
set -euo pipefail

# HashiCorp Vault PKI CA Installation Script
# Production-ready installer for Vault with PKI capabilities

# Colors for output
readonly RED='\033[0;31m'
readonly GREEN='\033[0;32m'
readonly YELLOW='\033[1;33m'
readonly NC='\033[0m'

# Global variables
VAULT_VERSION="1.15.6"
VAULT_USER="vault"
VAULT_CONFIG_DIR="/etc/vault.d"
VAULT_DATA_DIR="/opt/vault/data"
VAULT_LOG_DIR="/var/log/vault"

# Print colored output
print_status() {
    echo -e "${GREEN}[INFO]${NC} $1"
}

print_warning() {
    echo -e "${YELLOW}[WARN]${NC} $1"
}

print_error() {
    echo -e "${RED}[ERROR]${NC} $1"
}

# Usage message
usage() {
    cat << EOF
Usage: $0 [OPTIONS]
Install HashiCorp Vault as PKI Certificate Authority

OPTIONS:
    -h, --help              Show this help message
    -a, --api-addr ADDR     Vault API address (default: http://127.0.0.1:8200)
    -c, --cluster-addr ADDR Vault cluster address (default: http://127.0.0.1:8201)

Example:
    $0
    $0 --api-addr http://10.0.1.100:8200
EOF
    exit 1
}

# Parse command line arguments
API_ADDR="http://127.0.0.1:8200"
CLUSTER_ADDR="http://127.0.0.1:8201"

while [[ $# -gt 0 ]]; do
    case $1 in
        -h|--help)
            usage
            ;;
        -a|--api-addr)
            API_ADDR="$2"
            shift 2
            ;;
        -c|--cluster-addr)
            CLUSTER_ADDR="$2"
            shift 2
            ;;
        *)
            print_error "Unknown option: $1"
            usage
            ;;
    esac
done

# Cleanup function
cleanup() {
    local exit_code=$?
    if [[ $exit_code -ne 0 ]]; then
        print_error "Installation failed. Cleaning up..."
        systemctl stop vault 2>/dev/null || true
        systemctl disable vault 2>/dev/null || true
        userdel -r "$VAULT_USER" 2>/dev/null || true
        rm -rf "$VAULT_DATA_DIR" "$VAULT_CONFIG_DIR" "$VAULT_LOG_DIR"
        rm -f /etc/systemd/system/vault.service
        systemctl daemon-reload 2>/dev/null || true
    fi
}

trap cleanup ERR

# Check prerequisites
check_prerequisites() {
    print_status "[1/12] Checking prerequisites..."
    
    if [[ $EUID -ne 0 ]]; then
        print_error "This script must be run as root"
        exit 1
    fi
    
    if ! command -v systemctl &> /dev/null; then
        print_error "systemd is required but not found"
        exit 1
    fi
}

# Detect distribution
detect_distro() {
    print_status "[2/12] Detecting distribution..."
    
    if [[ ! -f /etc/os-release ]]; then
        print_error "Cannot detect distribution - /etc/os-release not found"
        exit 1
    fi
    
    . /etc/os-release
    case "$ID" in
        ubuntu|debian)
            PKG_MGR="apt"
            PKG_INSTALL="apt install -y"
            PKG_UPDATE="apt update && apt upgrade -y"
            ;;
        almalinux|rocky|centos|rhel|ol|fedora)
            PKG_MGR="dnf"
            PKG_INSTALL="dnf install -y"
            PKG_UPDATE="dnf update -y"
            ;;
        amzn)
            PKG_MGR="yum"
            PKG_INSTALL="yum install -y"
            PKG_UPDATE="yum update -y"
            ;;
        *)
            print_error "Unsupported distribution: $ID"
            exit 1
            ;;
    esac
    
    print_status "Detected: $PRETTY_NAME ($PKG_MGR)"
}

# Update system packages
update_system() {
    print_status "[3/12] Updating system packages..."
    $PKG_UPDATE
    
    case "$PKG_MGR" in
        apt)
            $PKG_INSTALL curl wget gnupg software-properties-common
            ;;
        dnf|yum)
            $PKG_INSTALL curl wget gnupg2 yum-utils
            ;;
    esac
}

# Add HashiCorp repository
add_hashicorp_repo() {
    print_status "[4/12] Adding HashiCorp repository..."
    
    case "$PKG_MGR" in
        apt)
            curl -fsSL https://apt.releases.hashicorp.com/gpg | gpg --dearmor -o /usr/share/keyrings/hashicorp-archive-keyring.gpg
            echo "deb [signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" > /etc/apt/sources.list.d/hashicorp.list
            apt update
            ;;
        dnf)
            dnf config-manager --add-repo https://rpm.releases.hashicorp.com/RHEL/hashicorp.repo
            ;;
        yum)
            yum-config-manager --add-repo https://rpm.releases.hashicorp.com/RHEL/hashicorp.repo
            ;;
    esac
}

# Install Vault
install_vault() {
    print_status "[5/12] Installing Vault..."
    $PKG_INSTALL vault
    
    if ! command -v vault &> /dev/null; then
        print_error "Vault installation failed"
        exit 1
    fi
    
    print_status "Vault $(vault version | head -n1) installed successfully"
}

# Create Vault user and directories
create_vault_user() {
    print_status "[6/12] Creating Vault system user and directories..."
    
    if ! id "$VAULT_USER" &>/dev/null; then
        useradd --system --home "$VAULT_CONFIG_DIR" --shell /bin/false "$VAULT_USER"
    fi
    
    mkdir -p "$VAULT_DATA_DIR" "$VAULT_CONFIG_DIR" "$VAULT_LOG_DIR"
    chown -R "$VAULT_USER:$VAULT_USER" "$VAULT_DATA_DIR" "$VAULT_CONFIG_DIR" "$VAULT_LOG_DIR"
    chmod 750 "$VAULT_DATA_DIR" "$VAULT_CONFIG_DIR"
    chmod 755 "$VAULT_LOG_DIR"
}

# Configure Vault
configure_vault() {
    print_status "[7/12] Creating Vault configuration..."
    
    cat > "$VAULT_CONFIG_DIR/vault.hcl" << EOF
storage "file" {
  path = "$VAULT_DATA_DIR"
}

listener "tcp" {
  address     = "0.0.0.0:8200"
  tls_disable = 1
}

api_addr = "$API_ADDR"
cluster_addr = "$CLUSTER_ADDR"
ui = true

# Enable audit logging
audit {
  enabled = true
  type = "file"
  file_path = "$VAULT_LOG_DIR/audit.log"
}

# Disable mlock for development (enable in production)
disable_mlock = true
EOF
    
    chown "$VAULT_USER:$VAULT_USER" "$VAULT_CONFIG_DIR/vault.hcl"
    chmod 640 "$VAULT_CONFIG_DIR/vault.hcl"
}

# Create systemd service
create_systemd_service() {
    print_status "[8/12] Creating systemd service..."
    
    cat > /etc/systemd/system/vault.service << 'EOF'
[Unit]
Description=HashiCorp Vault
Documentation=https://vaultproject.io/docs/
Requires=network-online.target
After=network-online.target

[Service]
Type=notify
User=vault
Group=vault
ProtectSystem=full
ProtectHome=read-only
PrivateTmp=yes
PrivateDevices=yes
SecureBits=keep-caps
AmbientCapabilities=CAP_IPC_LOCK
Capabilities=CAP_IPC_LOCK+ep
CapabilityBoundingSet=CAP_SYSLOG CAP_IPC_LOCK
NoNewPrivileges=yes
ExecStart=/usr/bin/vault server -config=/etc/vault.d/vault.hcl
ExecReload=/bin/kill -HUP $MAINPID
KillMode=process
Restart=on-failure
RestartSec=5
TimeoutStopSec=30
StartLimitInterval=60
StartLimitBurst=3
LimitNOFILE=65536
LimitMEMLOCK=infinity

[Install]
WantedBy=multi-user.target
EOF

    chmod 644 /etc/systemd/system/vault.service
}

# Configure firewall
configure_firewall() {
    print_status "[9/12] Configuring firewall..."
    
    if command -v ufw &> /dev/null && ufw status | grep -q "Status: active"; then
        ufw allow 8200/tcp comment "Vault API"
        ufw allow 8201/tcp comment "Vault Cluster"
    elif command -v firewall-cmd &> /dev/null && systemctl is-active firewalld &> /dev/null; then
        firewall-cmd --permanent --add-port=8200/tcp
        firewall-cmd --permanent --add-port=8201/tcp
        firewall-cmd --reload
    else
        print_warning "No active firewall detected. Manually configure firewall to allow ports 8200 and 8201"
    fi
}

# Start Vault service
start_vault_service() {
    print_status "[10/12] Starting Vault service..."
    
    systemctl daemon-reload
    systemctl enable vault
    systemctl start vault
    
    # Wait for Vault to start
    sleep 3
    
    if ! systemctl is-active vault &> /dev/null; then
        print_error "Vault service failed to start"
        systemctl status vault
        exit 1
    fi
}

# Set up environment
setup_environment() {
    print_status "[11/12] Setting up environment..."
    
    echo "export VAULT_ADDR='$API_ADDR'" > /etc/profile.d/vault.sh
    chmod 644 /etc/profile.d/vault.sh
    export VAULT_ADDR="$API_ADDR"
    
    # Wait for Vault API to be ready
    for i in {1..30}; do
        if vault status &> /dev/null; then
            break
        fi
        sleep 1
    done
}

# Verify installation
verify_installation() {
    print_status "[12/12] Verifying installation..."
    
    # Check service status
    if ! systemctl is-active vault &> /dev/null; then
        print_error "Vault service is not running"
        exit 1
    fi
    
    # Check Vault status
    if ! vault status &> /dev/null; then
        print_error "Cannot connect to Vault API"
        exit 1
    fi
    
    print_status "Vault installation completed successfully!"
    print_warning "Next steps:"
    echo "1. Initialize Vault: vault operator init -key-shares=5 -key-threshold=3"
    echo "2. Unseal Vault using 3 of the 5 unseal keys"
    echo "3. Configure PKI secrets engine"
    echo "4. Access Vault UI at: $API_ADDR"
    echo "5. Store unseal keys and root token securely!"
}

# Main installation function
main() {
    print_status "Starting HashiCorp Vault PKI CA installation..."
    
    check_prerequisites
    detect_distro
    update_system
    add_hashicorp_repo
    install_vault
    create_vault_user
    configure_vault
    create_systemd_service
    configure_firewall
    start_vault_service
    setup_environment
    verify_installation
    
    print_status "Installation completed successfully!"
}

main "$@"