no longer in use.

#!/bin/bash -e

# THIS SCRIPT requires the following paths to contain values:

# - secret/global/<aws-profile>/vault/<dev|prod|stage>/duo/{ikey,skey,host}

THIS_DIR=$(dirname $0)

source $THIS_DIR/utils/provision-func.sh

data_dir=$1

bash_defaults

# if VAULT_TOKEN is not set, use user token (we set since we use curl, not vault CLI)

if ! is_set VAULT_TOKEN; then

  if [ -f ~/.vault-token ]; then

    export VAULT_TOKEN=$(cat ~/.vault-token)

  else

    >&2 echo 'ERROR: either VAULT_TOKEN must be set or ~/.vault-token must exist'

    >&2 echo 'on your local machine you can do `vault auth -method ldap`'

    false

  fi

fi

echo "Verifying Vault is unsealed"

if ! vault status --address=$VAULT_ADDR > /dev/null; then

  >&2 echo 'ERROR: vault status --address=$VAULT_ADDR'

  false

fi

pushd $data_dir > /dev/null

# As of vault 0.10.4, default secret kv backend is enabled in version1. We need to convernt it to version2

vault kv enable-versioning secret/

vault secrets tune -description="KV 2" secret/

# MOUNT AUDIT BACKENDS

provision -c check_parent_list -C put_file -u do_nothing sys/audit/*.json

# MOUNT AUTH backends

provision -c check_parent_list -u do_nothing sys/auth/*.json

# MOUNT OTHER backends

provision -c check_parent_list -u do_nothing sys/mounts/*.json

vault secrets tune -max-lease-ttl=87600h pki

# Tune TTL for ldap token

vault secrets tune -default-lease-ttl=24h /auth/ldap

popd > /dev/null