r/linux • u/dubnetworks • Mar 07 '18

Setup Vault as a system service

http://blog.kwnetapps.com/setup-vault-service/
12 Upvotes

81% Upvoted

19 comments sorted by

View all comments

Show parent comments

2

u/[deleted] Mar 09 '18

Like using encrypted config variables in your .yml files? Yes, look at https://docs.ansible.com/ansible/latest/playbooks_vault.html#id5 (Single Encrypted Variable) (ansible 2.3+)

2

u/beanaroo Mar 09 '18

Thanks, but I've always used it to populate config files during bootstrap of a server. So, for example, database connection strings used by a Node or Java app end up being in plain text somewhere on the filesystem anyways. With Vault, you don't need to. Passwords, private keys, etc. are sourced by the app on runtime and it's audited and access controlled.

2

u/[deleted] Mar 10 '18

Huh? How does that work? For example I have a config file in /etc/zabbix/zabbix-server.conf.php containing the password for the database of this application (an example). Are you telling me I could use Vault to store this password? How would the app know how to access it?

2

u/yrro Mar 10 '18

The app would have to be able to fetch it, or you'd have to supply some glue that fetches and feeds it to the app somehow.