foxhunt/tests/e2e/vault_integration/fixtures/vault-setup/setup-vault.sh

#!/bin/bash
set -e

echo "Starting Vault PKI setup for E2E testing..."

# Wait for Vault to be ready
until vault status > /dev/null 2>&1; do
    echo "Waiting for Vault to be ready..."
    sleep 2
done

echo "Vault is ready. Setting up PKI secrets engine..."

# Enable PKI secrets engine
vault secrets enable -path=pki pki

# Set PKI max lease TTL
vault secrets tune -max-lease-ttl=8760h pki

# Generate root CA certificate
vault write pki/root/generate/internal \
    common_name="Foxhunt Test Root CA" \
    ttl=8760h \
    key_bits=4096

# Configure PKI URLs
vault write pki/config/urls \
    issuing_certificates="http://vault:8200/v1/pki/ca" \
    crl_distribution_points="http://vault:8200/v1/pki/crl"

# Create PKI role for HFT trading services
vault write pki/roles/hft-trading \
    allowed_domains="foxhunt.internal,trading.foxhunt.internal,backtesting.foxhunt.internal,tli.foxhunt.internal" \
    allow_subdomains=true \
    max_ttl="24h" \
    default_ttl="1h" \
    key_bits=2048 \
    key_type=rsa \
    allow_any_name=false \
    enforce_hostnames=false \
    allow_ip_sans=true \
    server_flag=true \
    client_flag=true

echo "PKI secrets engine configured successfully."

# Enable AppRole authentication method
echo "Setting up AppRole authentication..."
vault auth enable approle

# Create policy for trading services
vault policy write trading-policy - <<EOF
# Allow reading from PKI
path "pki/*" {
  capabilities = ["read", "list"]
}

# Allow certificate generation
path "pki/issue/hft-trading" {
  capabilities = ["create", "update"]
}

# Allow reading own token info
path "auth/token/lookup-self" {
  capabilities = ["read"]
}

# Allow token renewal
path "auth/token/renew-self" {
  capabilities = ["update"]
}
EOF

# Create AppRole for trading services
vault write auth/approle/role/trading-services \
    token_policies="trading-policy" \
    token_ttl=1h \
    token_max_ttl=4h \
    secret_id_ttl=24h

# Get role-id for testing
ROLE_ID=$(vault read -field=role_id auth/approle/role/trading-services/role-id)
echo "Role ID: $ROLE_ID"

# Generate secret-id for testing
SECRET_ID=$(vault write -field=secret_id auth/approle/role/trading-services/secret-id)
echo "Secret ID: $SECRET_ID"

# Store credentials for test services
mkdir -p /tmp/vault-credentials
echo "$ROLE_ID" > /tmp/vault-credentials/role_id
echo "$SECRET_ID" > /tmp/vault-credentials/secret_id

# Test certificate generation to verify setup
echo "Testing certificate generation..."
vault write pki/issue/hft-trading \
    common_name="test.foxhunt.internal" \
    ttl=1h \
    format=pem > /tmp/test-cert.pem

if [ $? -eq 0 ]; then
    echo "Certificate generation test successful!"
else
    echo "Certificate generation test failed!"
    exit 1
fi

# Enable intermediate CA for more realistic setup
echo "Setting up intermediate CA..."
vault secrets enable -path=pki_int pki
vault secrets tune -max-lease-ttl=43800h pki_int

# Generate intermediate CSR
vault write -format=json pki_int/intermediate/generate/internal \
    common_name="Foxhunt Test Intermediate CA" \
    ttl=43800h \
    key_bits=4096 | jq -r '.data.csr' > /tmp/pki_intermediate.csr

# Sign the intermediate certificate
vault write -format=json pki/root/sign-intermediate \
    csr=@/tmp/pki_intermediate.csr \
    format=pem_bundle \
    ttl=43800h | jq -r '.data.certificate' > /tmp/intermediate.cert.pem

# Set the intermediate certificate
vault write pki_int/intermediate/set-signed \
    certificate=@/tmp/intermediate.cert.pem

# Configure intermediate PKI URLs
vault write pki_int/config/urls \
    issuing_certificates="http://vault:8200/v1/pki_int/ca" \
    crl_distribution_points="http://vault:8200/v1/pki_int/crl"

# Create role in intermediate CA
vault write pki_int/roles/hft-trading \
    allowed_domains="foxhunt.internal,trading.foxhunt.internal,backtesting.foxhunt.internal,tli.foxhunt.internal" \
    allow_subdomains=true \
    max_ttl="24h" \
    default_ttl="1h" \
    key_bits=2048 \
    key_type=rsa \
    allow_any_name=false \
    enforce_hostnames=false \
    allow_ip_sans=true \
    server_flag=true \
    client_flag=true

# Update policy to include intermediate PKI
vault policy write trading-policy - <<EOF
# Allow reading from PKI
path "pki/*" {
  capabilities = ["read", "list"]
}

path "pki_int/*" {
  capabilities = ["read", "list"]
}

# Allow certificate generation
path "pki/issue/hft-trading" {
  capabilities = ["create", "update"]
}

path "pki_int/issue/hft-trading" {
  capabilities = ["create", "update"]
}

# Allow reading own token info
path "auth/token/lookup-self" {
  capabilities = ["read"]
}

# Allow token renewal
path "auth/token/renew-self" {
  capabilities = ["update"]
}
EOF

echo "Vault PKI setup completed successfully!"
echo "Root CA and Intermediate CA configured"
echo "AppRole authentication enabled"
echo "Role ID and Secret ID generated for testing"
echo ""
echo "Test the setup with:"
echo "  vault write pki_int/issue/hft-trading common_name=\"service.foxhunt.internal\" ttl=1h"