Refactor App Role docs and extract long Python script out of the

Markdown file.

docs/vault-approle.md

@@ -1,6 +1,6 @@
 # Automatic renewal of a client certificate on Ubuntu with Vault AppRole
 
-This guide shows how an unattended Ubuntu server gets a client certificate from a remote Vault server with the AppRole authentication method, and keeps it fresh. A systemd timer starts a renewal service, the service renews the certificate before it expires, and after a successful renewal it runs a configurable Bash hook that signals the application to reread the certificate or restarts it.
+This guide shows how an unattended Ubuntu server gets a client certificate from a remote Vault server with the AppRole authentication method, and keeps it fresh. A systemd timer starts a renewal service, the service renews the certificate before it expires, and after a successful renewal it runs a configurable Bash hook that signals the application to reread the certificate or restarts it. The server talks to Vault either with the Vault CLI (section 2) or with Python 3 through the Vault HTTP API (section 2a).
 
 ## Prerequisites
 
@@ -260,6 +260,43 @@ sudo systemctl daemon-reload
 sudo systemctl enable --now vault-cert-renew.timer
 ```
 
+## 2a. Alternative: use the Vault HTTP API on the server
+
+Role: **Server administrator**
+
+The server does not need the Vault CLI. Python 3 handles the HTTP calls and the JSON answers of the Vault API with its standard library only, and `openssl` creates the key and the CSR. Python 3 is `python3` 3.12 on Ubuntu 24.04 and 3.14 on Ubuntu 26.04. The configuration file, the hook and the systemd units from section 2 stay the same. Only three parts of section 2 are replaced: the installation of the Vault CLI, the unwrapping of the secret ID and the renewal script.
+
+### Install the tools
+
+Use these commands instead of the installation of the Vault CLI. They do nothing when the packages are already installed:
+
+```bash
+sudo apt update
+sudo apt install -y python3 openssl
+```
+
+### Install the renewal script
+
+The renewal script is `vault_cert_renew.py` in the repository. Install it at the path that the systemd service uses, `/usr/local/sbin/vault-cert-renew`, so the service stays unchanged:
+
+```bash
+sudo install -m 0755 vault_cert_renew.py /usr/local/sbin/vault-cert-renew
+```
+
+It reads the same settings from the configuration file, and `VAULT_ADDR` is required. With the `--unwrap` option it also stores the secret ID from a response wrapping token, so the Vault CLI is not needed for that either.
+
+The script has the same behavior as the CLI version: it exits without contacting Vault while the certificate is valid, replaces the files only when the new certificate matches the new key, and runs the hook after a successful renewal. The Vault token stays in memory and the batch token expires on its own. A failed Vault call prints the status code and the answer of Vault to the journal.
+
+### Store the credentials
+
+Create the directories and the credential files as in section 2 and write the role ID the same way. Then store the secret ID with the script. It asks for the wrapping token without echo, so the token does not appear in the process list or in the shell history. The configuration file is not read in this step, so pass the address of Vault:
+
+```bash
+sudo VAULT_ADDR=https://vault.example.com:8200 /usr/local/sbin/vault-cert-renew --unwrap
+```
+
+The wrapping token can be unwrapped only once, as with the CLI. The script writes the secret ID to `/etc/vault-cert/secret_id` with the access limited to root.
+
 ## 3. Verify and operate
 
 Role: **Server administrator**