#!/usr/bin/env bash
#
# Unseal a HashiCorp Vault instance using a password sealed into the TPM 2.0
# with tpm-seal-password.sh. Intended to run once, after vault.service has
# started, via vault-tpm2-unseal.service.
# Configuration is read from environment variables, normally supplied by
# systemd's EnvironmentFile= from /etc/vault.d/tpm2.env:
#   VAULT_ADDR         Vault API address (required)
#   TPM_UNSEAL_SCRIPT   Path to tpm-unseal-password.sh (default: /usr/local/sbin/tpm-unseal-password.sh)
#   TPM_HANDLE          Persistent TPM handle the key was sealed at (default: 0x81010001)
#   TPM_PCR_LIST        PCR bank/indices the key was bound to (default: sha256:7)

set -euo pipefail

: "${VAULT_ADDR:?VAULT_ADDR must be set}"
TPM_UNSEAL_SCRIPT="${TPM_UNSEAL_SCRIPT:-/usr/local/sbin/tpm-unseal-password.sh}"
TPM_HANDLE="${TPM_HANDLE:-0x81010001}"
TPM_PCR_LIST="${TPM_PCR_LIST:-sha256:7}"

command -v vault >/dev/null || {
	echo "vault CLI not found in PATH" >&2
	exit 1
}

[ -x "$TPM_UNSEAL_SCRIPT" ] || {
	echo "${TPM_UNSEAL_SCRIPT} not found or not executable" >&2
	exit 1
}

set +e
vault status -address="$VAULT_ADDR" >/dev/null
STATUS=$?
set -e

case "$STATUS" in
0)
	echo "Vault at ${VAULT_ADDR} is already unsealed"
	exit 0
	;;
2)
	;;
*)
	echo "vault status against ${VAULT_ADDR} failed (exit ${STATUS})" >&2
	exit 1
	;;
esac

KEY=$("$TPM_UNSEAL_SCRIPT" -H "$TPM_HANDLE" -l "$TPM_PCR_LIST")

vault operator unseal -address="$VAULT_ADDR" "$KEY" >/dev/null

unset KEY

echo "Vault at ${VAULT_ADDR} unsealed via TPM handle ${TPM_HANDLE}"