github.com/hyperion-hyn/go-ethereum@v2.4.0+incompatible/docs/Privacy/Tessera/Tessera Services/Keys/Setting up a Hashicorp Vault.md (about)

     1  The private/public key pairs used by Tessera can be [stored](../Keys) in and [retrieved](../../../Configuration/Keys) from a key vault, preventing the need to store the keys locally.
     2  
     3  This page details how to set up and configure a Hashicorp Vault for use with Tessera.
     4  
     5   The [Hashicorp Vault Getting Started documentation](https://learn.hashicorp.com/vault/) provides much of the information needed to get started.  The following section goes over some additional considerations when running Tessera with Vault.
     6  
     7  ## Configuring the vault
     8  
     9  ### TLS
    10  When running in production situations it is advised to configure the Vault server for 2-way (mutual) TLS communication.  Tessera also supports 1-way TLS and unsecured (no TLS) communications with a Vault server.
    11  
    12  An example configuration for the Vault listener to use 2-way TLS is shown below.  This can be included as part of the `.hcl` used when starting the Vault server:
    13  
    14  ```
    15  listener "tcp" {
    16          tls_min_version = "tls12"
    17          tls_cert_file = "/path/to/server.crt"
    18          tls_key_file = "/path/to/server.key"
    19          tls_require_and_verify_client_cert = "true"
    20          tls_client_ca_file = "/path/to/client-ca.crt"
    21  }
    22  ```
    23  
    24  ### Auth methods
    25  Tessera directly supports the [AppRole](https://www.vaultproject.io/docs/auth/approle.html) auth method.  If required, other auth methods can be used by logging in outside of Tessera (e.g. using the HTTP API) and providing the resulting vault token to Tessera.  See the *Enabling Tessera to use the vault* section below for more information.
    26  
    27  When using AppRole, Tessera assumes the default auth path to be `approle`, however this value can be overwritten.  See [Keys](../../../Configuration/Keys) for more information.
    28  
    29  ### Policies
    30  To be able to carry out all possible interactions with a Vault, Tessera requires the following policy capabilities: `["create", "update", "read"]`.  A subset of these capabilities can be configured if not all functionality is required.
    31  
    32  ### Secret engines
    33  Tessera can read and write keys to the following secret engine type:
    34  
    35  - [K/V Version 2](https://www.vaultproject.io/docs/secrets/kv/kv-v2.html)
    36  
    37  The K/V Version 2 secret engine supports versioning of secrets, however only a limited number of versions are retained.  This number can be changed as part of the Vault configuration process.
    38  
    39  ## Enabling Tessera to use the vault
    40  ### Environment Variables
    41  If using a Hashicorp Vault, Tessera requires certain environment variables to be set depending on the auth method being used.
    42  
    43  - If using the AppRole auth method, set:
    44      1. `HASHICORP_ROLE_ID`
    45      2. `HASHICORP_SECRET_ID`
    46  
    47    These credentials are obtained as outlined in the [AppRole documentation](https://www.vaultproject.io/docs/auth/approle.html).  Tessera will use these credentials to authenticate with Vault.
    48  
    49  - If using the root token or you already have a token due to authorising with an alternative method, set:
    50    1. `HASHICORP_TOKEN`
    51  
    52  !!! note
    53      If using TLS additional environment variables must be set.  See [Keys](../../../Configuration/Keys) for more information as well as details of the Tessera configuration required to retrieve keys from a Vault.
    54  
    55  ### Dependencies
    56  The Hashicorp dependencies are included in the `tessera-app-<version>-app.jar`.  If using the `tessera-simple-<version>-app.jar` then `hashicorp-key-vault-<version>-all.jar` must be added to the classpath.