Conversation
Gives a one-command dev machine path (./setup.sh) with persistent Shamir Vault, tenant isolation, and optional dynamic credentials. Does not change GitHub master.
BSick7
reviewed
Aug 24, 2026
BSick7
left a comment
BSick7
left a comment
Contributor
There was a problem hiding this comment.
This is a really good start.
I think we should do a few things:
- create a go library rather than a federation of bash scripts
- build tests using go; wind down the CI to be simpler and be able to run tests locally
- package a vault utils docker image that is maintained in this repo containing all bootstrap utils
- adjust the docker compose to execute this bootstrap as a one time execution
Co-authored-by: Brad Sickles <brad.sickles@gmail.com>
* Replace local Shamir sidecar with a vault-utils one-shot Move bootstrap into a Go library and CLI so isolation can be tested with go test (HTTP 403), and Compose unseal is a one-shot instead of a long-running sidecar. * Start Postgres from .env and drop extra comments ./setup.sh was skipping Postgres when credentials were already enabled in .env, so bootstrap failed looking up the database host. * Fix isolation CI: use docker run stdout as the container ID Image pull noise on stderr was mixed into CombinedOutput, so docker port failed on GitHub Actions. * Trim comments and replace em dashes Keep operator-facing behavior. Drop essay comments from Compose, CI, and local scripts. * Align local bootstrap with vault-utils as the only path Compose runs bootstrap once by default. CI isolation is go test. tenant-offboard is in the image. Remove the bash sidecar and bash local bootstrap scripts. * Move shared trees under internal/ and local/, and stop treating local-dev passwords as Vault -dev. * Remove bash bootstrap and mirrored scripts, and run lint and conformance as Go tests. Vault bootstrap is only vault-utils. Compose keeps setup, snapshot, and reset. Isolation then credentials no longer 404s on database roles. * Restructure vault-utils into subcommands with a pluggable key store Bootstrap only initializes a cluster (init, unseal, configure, tokens, revoke root) and persists key material through a KeyStore interface so cloud platforms can plug in secret managers. Tenants are created explicitly with tenants create. Policy templates use Go text/template. compose.yml carries inline digest-pinned images. Snapshot take, list, verify, and restore move from bash into the binary. * Removed scripts, dropped postgres * Remove the shellcheck CI job; no shell scripts remain --------- Co-authored-by: Brad Sickles <brad.sickles@gmail.com>
* Add aws-vault-ec2-cluster connections, IAM, and security groups. This is the Nullstone AWS module skeleton so a workspace can attach VPC, snapshot S3, and unseal KMS before ASG and NLB work. * Address review: rename and relocate aws-ec2-vault-cluster. Move the module under aws/aws-ec2-vault-cluster so naming matches other Nullstone AWS modules, and apply the connection and variable comments.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Local Docker Compose target for a tenant-isolated Vault CE cluster. One command on a dev machine:
./setup.sh.kv/customers/{tenant}/*. Not Enterprise namespaces../setup.sh --with-credentials).aws/,gcp/, andazure/are placeholders only. No Terraform yet.Operator, architecture, DR, and break-glass docs live in
README.md.What is in this branch
setup.sh/local/: Compose, unseal sidecar, health, stop, resetconfig/scripts/: policies, AppRole, KV v2, tenant onboard/offboardtests/: isolation and credentials conformanceREADME.md: how to run, isolation, backup/restore, break-glassTest plan
./setup.sh(isolation only: Vault + unseal, no Postgres)./tests/run-conformance.sh --layer isolation./local/tests/runtime-test.sh(restart keeps data, sidecar unseals)./setup.sh --with-credentials./tests/run-conformance.sh --layer all(zero leftoverv-*roles)