slawekandClaude Sonnet 5
91f1abef8a
Add vault-tpm2-unseal.sh/.service to unseal Vault once after boot using the TPM-sealed key, and tpm-bootstrap-1password.sh to (re)seal that key from a 1Password secret reference. Document PCR policy selection, the Vault service, and the host-specific tpm2.env (gitignored, example in README) in README.md. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
55 lines
1.5 KiB
Bash
Executable File
55 lines
1.5 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
#
|
|
# Unseal a HashiCorp Vault instance using a password sealed into the TPM 2.0
|
|
# with tpm-seal-password.sh. Intended to run once, after vault.service has
|
|
# started, via vault-tpm2-unseal.service.
|
|
# Configuration is read from environment variables, normally supplied by
|
|
# systemd's EnvironmentFile= from /etc/vault.d/tpm2.env:
|
|
# VAULT_ADDR Vault API address (required)
|
|
# TPM_UNSEAL_SCRIPT Path to tpm-unseal-password.sh (default: /usr/local/sbin/tpm-unseal-password.sh)
|
|
# TPM_HANDLE Persistent TPM handle the key was sealed at (default: 0x81010001)
|
|
# TPM_PCR_LIST PCR bank/indices the key was bound to (default: sha256:7)
|
|
|
|
set -euo pipefail
|
|
|
|
: "${VAULT_ADDR:?VAULT_ADDR must be set}"
|
|
TPM_UNSEAL_SCRIPT="${TPM_UNSEAL_SCRIPT:-/usr/local/sbin/tpm-unseal-password.sh}"
|
|
TPM_HANDLE="${TPM_HANDLE:-0x81010001}"
|
|
TPM_PCR_LIST="${TPM_PCR_LIST:-sha256:7}"
|
|
|
|
command -v vault >/dev/null || {
|
|
echo "vault CLI not found in PATH" >&2
|
|
exit 1
|
|
}
|
|
|
|
[ -x "$TPM_UNSEAL_SCRIPT" ] || {
|
|
echo "${TPM_UNSEAL_SCRIPT} not found or not executable" >&2
|
|
exit 1
|
|
}
|
|
|
|
set +e
|
|
vault status -address="$VAULT_ADDR" >/dev/null
|
|
STATUS=$?
|
|
set -e
|
|
|
|
case "$STATUS" in
|
|
0)
|
|
echo "Vault at ${VAULT_ADDR} is already unsealed"
|
|
exit 0
|
|
;;
|
|
2)
|
|
;;
|
|
*)
|
|
echo "vault status against ${VAULT_ADDR} failed (exit ${STATUS})" >&2
|
|
exit 1
|
|
;;
|
|
esac
|
|
|
|
KEY=$("$TPM_UNSEAL_SCRIPT" -H "$TPM_HANDLE" -l "$TPM_PCR_LIST")
|
|
|
|
vault operator unseal -address="$VAULT_ADDR" "$KEY" >/dev/null
|
|
|
|
unset KEY
|
|
|
|
echo "Vault at ${VAULT_ADDR} unsealed via TPM handle ${TPM_HANDLE}"
|