Initial commit

templates/config/vault/barong.hcl.erb

@@ -0,0 +1,32 @@
+# Access system health status
+path "sys/health" {
+  capabilities = ["read", "list"]
+}
+# Manage the transit secrets engine
+path "transit/keys/<%= @config['app']['name'].downcase %>_*" {
+  capabilities = ["create", "read", "list"]
+}
+# Encrypt API keys
+path "transit/encrypt/<%= @config['app']['name'].downcase %>_apikeys_*" {
+  capabilities = ["create", "read", "update"]
+}
+# Decrypt API keys
+path "transit/decrypt/<%= @config['app']['name'].downcase %>_apikeys_*" {
+  capabilities = ["create", "read", "update"]
+}
+# Renew tokens
+path "auth/token/renew" {
+  capabilities = ["update"]
+}
+# Lookup tokens
+path "auth/token/lookup" {
+  capabilities = ["update"]
+}
+# Manage otp keys
+path "totp/keys/*" {
+  capabilities = ["create", "read", "update", "delete"]
+}
+# Verify an otp code
+path "totp/code/*" {
+  capabilities = ["read","update"]
+}