Search code examples
configurationconsulhashicorp-vault

Hashicorp Vault stops being initialised after reboot

For some testing purposes I've installed Vault with Consul as a backend on a single AWS EC2 Instance. I initialise and unseal it successfully. Everything works good, and I can make my tests.

But every time when I stop the EC2 Instance and start it again, the Vault is not initialised (the command vault status shows "Initialised" - "false"). As a result I need to init the Vault again and lose all my secrets.

Is there a way to keep Vault being initialised after stoping the EC2 instance and starting it again?

The vault configuration files:

  • config.hcl
storage "consul" {
    address = "127.0.0.1:8500"
    path    = "vault/"
}

listener "tcp" {
    address  = "0.0.0.0:8200"
    tls_disable = 1
}

ui = true
  • vault.service
[Unit]
Description="Hashicorp Vault - A tool for managing secrets"
Documentation=https://www.vaultproject.io/docs/
ConditionFileNotEmpty=/etc/vault.d/config.hcl

[Service]
ExecStart=/usr/bin/vault server -config=/etc/vault.d/config.hcl
ExecReload=/bin/kill --signal HUP $MAINIP
LimitNOFILE=65536

[Install]
WantedBy=multi-user.target

The consul configuration files:

  • consul.hcl
datacenter = "dc1"
data_dir = "/tmp/consul"
encrypt = ""
  • server.hcl
datacenter = "dc1"
data_dir = "/tmp/consul"
encrypt = ""
  • consul.service
[Unit]
Description=Consul
Documentation=https://www.consul.io/

[Service]
ExecStart=/usr/bin/consul agent -ui -config-dir=/etc/consul.d/
ExecReload=/bin/kill -HUP $MAINIP
LimitNOFILE=65536

[Install]
WantedBy=multi-user.target

Would appreciate any ideas.

Solution

  • Vault is leveraging Consul to store its data, but you have Consul storing that data inside /tmp which is a volatile directory and is emptied on reboot.

    datacenter = "dc1"
data_dir = "/tmp/consul"
encrypt = ""

    Try changing data_dir to something like /var/consul