Skip to content

Vault Hetzner GCP

Investigate and test confidential computing and vault (https://app.clickup.com/t/861mf0g0x) Write documentation about confidential computing vm, external key management etc (https://app.clickup.com/t/861med4ck)

To Do:

Bind a GCP service account to a vault role Ask Jonne to test applications with us

Terraform: give these permissions to enable os logging: cloudkms.orgServiceAgent service-org-440817507889@gcp-sa-cloudkms.iam.gserviceaccount.com

Create and enable snapshot schedules for disks

Terraform

https://github.com/Attracs/terraform-attracs-services-195009

GCP

Ansible

https://github.com/Attracs/attracs-linux-playbooks?tab=readme-ov-file#server-bootstrap

./attracs-server-bootstrap.sh \
  -s root@34.88.85.36 \
  -p .vault_password_file \
  -i ./inventory/linux-servers.ini \
  -l tms-confidential-template \
  -h tms-confidential-template

Output of the ansible bootstrap:

cc-template-instance-ansible-bootstrap-output-2024-01-16.txt

Vault Docker

docker-compose.yml configuration/ data/

Vault configuration

vault list auth/... vault read auth/... vault write auth/...