$OpenBSD: README,v 1.3 2020/05/02 06:35:12 ajacoutot Exp $

+-----------------------------------------------------------------------
| Running vault on OpenBSD
+-----------------------------------------------------------------------

Default Vault locations
=======================
	configuration:	/etc/vault/vault.hcl
	logs:		/var/log/vault/
	plugins:	/var/vault/plugins/
	storage:	/var/vault/storage/

Default configuration
=====================

Default storage engine
----------------------
For more info on integrated Raft storage backend, see:
check https://www.vaultproject.io/docs/concepts/integrated-storage

disable_mlock option
--------------------
Without this option, "vault operator init" will SIGSEGV.
Since OpenBSD encrypts swap by default, this fixes the problem with leaking
plaintext secrets via swap thus setting disable_mlock=true considered harmless.

Initializing Vault
==================
Check the following /etc/vault/vault.hcl configuration options:
	api_addr
	cluster_addr
	cluster_name
	listener address
	listener cluster_address
	storage node_id

and set to the real cluster/node addresses/names for cluster/client
communications.

Enable and start Vault server:
	# rcctl enable vault && rcctl start vault
      
Set environment variable appropriately:
	$ export VAULT_ADDR="http://localhost:8200"

Initialize Vault:
	$ vault operator init

Unseal Vault:
	$ vault operator unseal

For more information on Vault server deployment, see:
https://learn.hashicorp.com/vault/getting-started/deploy

Note, that Vault server supports PGP, GPG and Keybase for unseal keys,
for more info, see:
https://www.vaultproject.io/docs/concepts/pgp-gpg-keybase.html

Auditing Vault operations
--------------------------
To enable writing audit logs to /var/log/vault/, run
	$ vault audit enable file file_path=/var/log/vault/audit.log mode=0640

Logging
-------
Vault server uses logger(1) to log to syslogd(8) with daemon.info facility/level
and tag "vault". If you want to use a separate file for Vault server logs, add
the following lines to the top of /etc/syslog.conf:
	!!vault
	*.*						/var/log/vault/vault.log
	!*

create logfile:
	# install -Do _vault -g _vault -m 0640 /dev/null /var/log/vault/vault.log

and restart syslogd(8):
	# rcctl reload syslogd

For log rotation, adjust/add the following lines to /etc/newsyslog.conf:
	/var/log/vault/audit.log _vault:_vault  640  7     *    $D23  Z "rcctl reload vault"
	/var/log/vault/vault.log _vault:_vault  640  7     *    $D23  Z
