# Vault configuration

## Introduction

This document describe how to create vault tokens in order to configure **peatio-rails** to be able **to encrypt** secrets, **to renew** token and **to manage** totp, to configure **peatio-crypto-daemons** to be able **to encrypt** secrets, **to decrypt** secrets, **to renew** token, to configure **peatio-upstream-proxy** to be able **to decrypt** secrets, **to renew** token. 

## Connect to vault

You can validate it works running the following command:
```bash
$ vault status

Type: shamir
Sealed: false
Key Shares: 1
Key Threshold: 1
Unseal Progress: 0
Unseal Nonce: 
Version: 1.3.4
Cluster Name: vault-cluster-650930cf
Cluster ID: 9f40327d-ec71-9655-b728-7588ce47d0b4

High-Availability Enabled: false
```

## Create ACL groups

### Create the following policy files

**peatio-rails.hcl**

```bash
# Manage the transit secrets engine
path "transit/keys/*" {
  capabilities = [ "create", "read", "list" ]
}

# Encrypt engines secrets
path "transit/encrypt/opendax_engines_*" {
  capabilities = [ "create", "read", "update" ]
}

# Encrypt wallets secrets
path "transit/encrypt/opendax_wallets_*" {
  capabilities = [ "create", "read", "update" ]
}

# Encrypt beneficiaries data
path "transit/encrypt/opendax_beneficiaries_*" {
  capabilities = [ "create", "read", "update" ]
}

# Decrypt beneficiaries data
path "transit/decrypt/opendax_beneficiaries_*" {
  capabilities = [ "create", "read", "update" ]
}

# Renew tokens
path "auth/token/renew" {
  capabilities = [ "update" ]
}

# Lookup tokens
path "auth/token/lookup" {
  capabilities = [ "update" ]
}

# Verify an otp code
path "totp/code/opendax_*" {
  capabilities = ["update"]
}
```

**peatio-crypto-daemons.hcl**

```bash
# Manage the transit secrets engine
path "transit/keys/*" {
  capabilities = [ "create", "read", "list" ]
}

# Encrypt Payment Addresses secrets
path "transit/encrypt/opendax_payment_addresses_*" {
  capabilities = [ "create", "read", "update" ]
}

# Decrypt Payment Addresses secrets
path "transit/decrypt/opendax_payment_addresses_*" {
  capabilities = [ "create", "read", "update" ]
}

# Decrypt wallets secrets
path "transit/decrypt/opendax_wallets_*" {
  capabilities = [ "create", "read", "update" ]
}

# Renew tokens
path "auth/token/renew" {
  capabilities = [ "update" ]
}

# Lookup tokens
path "auth/token/lookup" {
  capabilities = [ "update" ]
}
```

**peatio-upstream-proxy.hcl**

```bash
# Manage the transit secrets engine
path "transit/keys/*" {
  capabilities = [ "create", "read", "list" ]
}

# Decrypt Engines secrets
path "transit/decrypt/opendax_engines_*" {
  capabilities = [ "create", "read", "update" ]
}

# Renew tokens
path "auth/token/renew" {
  capabilities = [ "update" ]
}

# Lookup tokens
path "auth/token/lookup" {
  capabilities = [ "update" ]
}
```

### Create the ACL groups in vault

```bash
vault policy write peatio-rails peatio-rails.hcl
vault policy write peatio-crypto-daemons peatio-crypto-daemons.hcl
vault policy write peatio-upstream-proxy peatio-upstream-proxy.hcl
```

### Create applications tokens

```bash
vault token create -policy=peatio-rails -period=240h
vault token create -policy=peatio-crypto-daemons -period=240h
vault token create -policy=peatio-upstream-proxy -period=240h
```

## Configure Peatio

Set those variables according to your deployment:
```bash
export VAULT_ADDR=http://127.0.0.1:8200
export VAULT_TOKEN=s.jyH1vmrOmkZ0FZZ0NZtgRenS
export VAULT_APP_NAME=opendax
```