Learn Vault - Integrating Vault with Web Apps (Node.js, Go, Python, Laravel)

path "secret/data/myapp" {
  capabilities = ["read"]
}
 
path "transit/encrypt/my-key" {
  capabilities = ["create", "update"]
}

vault policy write web-app web-app-policy.hcl
vault auth enable approle
 
vault write auth/approle/role/web-app \
  secret_id_ttl=24h \
  token_ttl=1h \
  token_max_ttl=24h \
  policies="web-app"
 
vault read -field=role_id auth/approle/role/web-app/role-id
vault write -f -field=secret_id auth/approle/role/web-app/secret-id

pip install hvac

import os
import time
import hvac
 
client = hvac.Client(url=os.environ["VAULT_ADDR"])
 
# 1. Log in via AppRole
client.auth.approle.login(
    role_id=os.environ["VAULT_ROLE_ID"],
    secret_id=os.environ["VAULT_SECRET_ID"],
)
 
# 2. Fetch dynamic DB credentials (usually called at connection init)
creds = client.secrets.database.generate_credentials(name="web-role")
username = creds["data"]["username"]
password = creds["data"]["password"]
lease_id = creds["lease_id"]
print(f"Got DB creds: {username} (lease: {lease_id})")
 
# 3. Renew the lease before it expires (role's default TTL, e.g. 1 hour)
client.sys.renew_lease(lease_id=lease_id, increment=3600)

npm install node-vault

const vault = require("node-vault")({
  apiVersion: "v1",
  endpoint: process.env.VAULT_ADDR,
});
 
async function main() {
  // 1. Log in via AppRole
  await vault.approleLogin({
    role_id: process.env.VAULT_ROLE_ID,
    secret_id: process.env.VAULT_SECRET_ID,
  });
 
  // 2. Read KV v2 (data.data holds the payload, metadata alongside it)
  const { data } = await vault.read("secret/data/myapp");
  const dbHost = data.data.DB_HOST;
  const dbPass = data.data.DB_PASSWORD;
  console.log(`DB_HOST=${dbHost}`);
 
  // 3. Encrypt sensitive data via Transit (EaaS - episode 6)
  const plaintext = Buffer.from("NIK: 3171xxxxxxxxxx").toString("base64");
  const enc = await vault.write("transit/encrypt/my-key", { plaintext });
  console.log(`Ciphertext: ${enc.data.ciphertext}`);
 
  const dec = await vault.write("transit/decrypt/my-key", {
    ciphertext: enc.data.ciphertext,
  });
  const original = Buffer.from(dec.data.plaintext, "base64").toString("utf8");
  console.log(`Decrypted: ${original}`);
}
 
main().catch((err) => {
  console.error("Vault call failed:", err.message);
  process.exit(1);
});

package main
 
import (
	"fmt"
	"os"
 
	vaultapi "github.com/hashicorp/vault/api"
)
 
func main() {
	config := vaultapi.DefaultConfig()
	config.Address = os.Getenv("VAULT_ADDR")
 
	client, err := vaultapi.NewClient(config)
	if err != nil {
		panic(err)
	}
 
	// 1. Log in via AppRole
	secret, err := client.Logical().Write("auth/approle/login", map[string]interface{}{
		"role_id":   os.Getenv("VAULT_ROLE_ID"),
		"secret_id": os.Getenv("VAULT_SECRET_ID"),
	})
	if err != nil {
		panic(err)
	}
	client.SetToken(secret.Auth.ClientToken)
 
	// 2. Read the KV v2 secret
	s, err := client.Logical().Read("secret/data/myapp")
	if err != nil {
		panic(err)
	}
	payload := s.Data["data"].(map[string]interface{})
	fmt.Println("DB_HOST:", payload["DB_HOST"])
}

package main
 
import (
	"log"
	"time"
 
	vaultapi "github.com/hashicorp/vault/api"
)
 
// renewCredential uses a LifetimeWatcher to renew the lease periodically
// while the app is alive, and stops when the process is shut down.
func renewCredential(client *vaultapi.Client, leaseID string) {
	watcher, err := client.NewLifetimeWatcher(&vaultapi.LifetimeWatcherInput{
		Secret: &vaultapi.Secret{
			LeaseID:       leaseID,
			Renewable:     true,
			LeaseDuration: 3600,
		},
		Increment: 3600,
	})
	if err != nil {
		log.Fatal(err)
	}
 
	stopCh := make(chan struct{})
	go func() {
		time.Sleep(24 * time.Hour)
		close(stopCh) // stop the watcher when the app shuts down
	}()
	go watcher.Start()
	defer watcher.Stop()
 
	for {
		select {
		case <-stopCh:
			client.Sys().Revoke(leaseID)
			return
		}
	}
}

'connections' => [
    'mysql' => [
        'driver'    => 'mysql',
        'host'      => env('DB_HOST', '127.0.0.1'),
        'database'  => env('DB_DATABASE', 'forge'),
        'username'  => env('DB_USERNAME', 'forge'),
        'password'  => env('DB_PASSWORD', ''),
        // Laravel doesn't care where the secret came from - env() is enough
    ],
],

use Xenolope\Vault\Client as VaultClient;
use GuzzleHttp\Client as HttpClient;
 
public function boot(): void
{
    $http = new HttpClient([
        'base_uri' => env('VAULT_ADDR', 'http://127.0.0.1:8200'),
    ]);
 
    $vault = new VaultClient($http);
 
    // 1. Log in via AppRole
    $vault->authenticate(
        'approle',
        [
            'role_id'   => env('VAULT_ROLE_ID'),
            'secret_id' => env('VAULT_SECRET_ID'),
        ]
    );
 
    // 2. Read the KV v2 secret -> store into runtime config
    $secret = $vault->get('secret/data/myapp');
    config(['database.connections.mysql.password' =>
        $secret['data']['data']['DB_PASSWORD']]);
}

import os
import time
import hvac
 
 
def get_vault_client(max_retries: int = 5) -> hvac.Client:
    """Log in with retry + exponential backoff."""
    client = hvac.Client(url=os.environ["VAULT_ADDR"])
    for attempt in range(max_retries):
        try:
            client.auth.approle.login(
                role_id=os.environ["VAULT_ROLE_ID"],
                secret_id=os.environ["VAULT_SECRET_ID"],
            )
            return client
        except Exception:
            if attempt == max_retries - 1:
                raise
            time.sleep(2 ** attempt)  # 1, 2, 4, 8, 16 seconds
    raise RuntimeError("Vault unreachable")
 
 
def read_secret_or_fallback(client: hvac.Client, path: str) -> dict:
    """Read a secret; if Vault is down, fall back to env injected at deploy."""
    try:
        resp = client.secrets.kv.v2.read_secret_version(path=path)
        return resp["data"]["data"]
    except Exception:
        return {
            "DB_HOST": os.environ.get("DB_HOST"),
            "DB_PASSWORD": os.environ.get("DB_PASSWORD"),
        }