Add installation script for TPM unseal and bootstrap services

2026-08-29 19:36:46 +02:00
parent 949b5763fc
commit c2e08a6a5f
2 changed files with 13 additions and 0 deletions
@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+
+install -m 0755 -o root -g root tpm-unseal-password.sh /usr/local/sbin/tpm-unseal-password.sh
+install -m 0755 -o root -g root tpm-bootstrap-1password.sh /usr/local/sbin/tpm-bootstrap-1password.sh
+install -m 0755 -o root -g root vault-tpm2-unseal.sh /usr/local/sbin/vault-tpm2-unseal.sh
+install -m 0644 -o root -g root vault-tpm2-unseal.service /etc/systemd/system/vault-tpm2-unseal.service
+systemctl daemon-reload
+systemctl enable vault-tpm2-unseal.service
@@ -12,6 +12,11 @@

 set -euo pipefail

+CONFIG="/etc/vault.d/tpm2.env"
+if [ -r "$CONFIG" ]; then
+	set -a; . "$CONFIG"; set +a
+fi
+
 : "${VAULT_ADDR:?VAULT_ADDR must be set}"
 TPM_UNSEAL_SCRIPT="${TPM_UNSEAL_SCRIPT:-/usr/local/sbin/tpm-unseal-password.sh}"
 TPM_HANDLE="${TPM_HANDLE:-0x81010001}"