27 lines
1.1 KiB
Bash
Executable File
27 lines
1.1 KiB
Bash
Executable File
#!/bin/sh
|
|
|
|
set -euo pipefail
|
|
|
|
if [ "$(vault secrets list -format json | jq -r '.["[[ .vault.root ]]database/"].type')" != "database" ]; then
|
|
vault secrets enable -path [[ .vault.root ]]database database
|
|
fi
|
|
|
|
if [ "$(vault list -format json [[ .vault.root ]]database/config | jq '.[] | test("^[[ .instance ]]$")')" = "false" ]; then
|
|
vault write [[ .vault.root ]]database/config/[[ .instance ]] \
|
|
plugin_name="mysql-database-plugin" \
|
|
connection_url="{{username}}:{{password}}@tcp([[ (urlParse .mariadb.server.public_address).Host ]])/" \
|
|
allowed_roles="*" \
|
|
username=vault \
|
|
password="$(vault kv get -field vault_initial_pwd [[ .vault.root ]]kv/service/[[ .instance ]])" \
|
|
disable_escaping=true
|
|
vault write -force [[ .vault.root ]]database/rotate-root/[[ .instance ]]
|
|
fi
|
|
|
|
vault write [[ .vault.root ]]database/roles/mariadb-admin \
|
|
db_name="mariadb" \
|
|
creation_statements="CREATE USER '{{name}}'@'%' IDENTIFIED BY '{{password}}'; \
|
|
GRANT ALL PRIVILEGES ON *.* TO '{{name}}'@'%' WITH GRANT OPTION; \
|
|
FLUSH PRIVILEGES;" \
|
|
default_ttl="6h" \
|
|
max_ttl="48h"
|