initial commit

.gitignore

@@ -0,0 +1,156 @@
+
+# Created by https://www.toptal.com/developers/gitignore/api/go,intellij+all,terraform
+# Edit at https://www.toptal.com/developers/gitignore?templates=go,intellij+all,terraform
+
+### Go ###
+# Binaries for programs and plugins
+*.exe
+*.exe~
+*.dll
+*.so
+*.dylib
+
+# Test binary, built with `go test -c`
+*.test
+
+# Output of the go coverage tool, specifically when used with LiteIDE
+*.out
+
+# Dependency directories (remove the comment below to include it)
+# vendor/
+
+### Go Patch ###
+/vendor/
+/Godeps/
+
+### Intellij+all ###
+# Covers JetBrains IDEs: IntelliJ, RubyMine, PhpStorm, AppCode, PyCharm, CLion, Android Studio, WebStorm and Rider
+# Reference: https://intellij-support.jetbrains.com/hc/en-us/articles/206544839
+
+# User-specific stuff
+.idea/**/workspace.xml
+.idea/**/tasks.xml
+.idea/**/usage.statistics.xml
+.idea/**/dictionaries
+.idea/**/shelf
+
+# AWS User-specific
+.idea/**/aws.xml
+
+# Generated files
+.idea/**/contentModel.xml
+
+# Sensitive or high-churn files
+.idea/**/dataSources/
+.idea/**/dataSources.ids
+.idea/**/dataSources.local.xml
+.idea/**/sqlDataSources.xml
+.idea/**/dynamic.xml
+.idea/**/uiDesigner.xml
+.idea/**/dbnavigator.xml
+
+# Gradle
+.idea/**/gradle.xml
+.idea/**/libraries
+
+# Gradle and Maven with auto-import
+# When using Gradle or Maven with auto-import, you should exclude module files,
+# since they will be recreated, and may cause churn.  Uncomment if using
+# auto-import.
+# .idea/artifacts
+# .idea/compiler.xml
+# .idea/jarRepositories.xml
+# .idea/modules.xml
+# .idea/*.iml
+# .idea/modules
+# *.iml
+# *.ipr
+
+# CMake
+cmake-build-*/
+
+# Mongo Explorer plugin
+.idea/**/mongoSettings.xml
+
+# File-based project format
+*.iws
+
+# IntelliJ
+out/
+
+# mpeltonen/sbt-idea plugin
+.idea_modules/
+
+# JIRA plugin
+atlassian-ide-plugin.xml
+
+# Cursive Clojure plugin
+.idea/replstate.xml
+
+# Crashlytics plugin (for Android Studio and IntelliJ)
+com_crashlytics_export_strings.xml
+crashlytics.properties
+crashlytics-build.properties
+fabric.properties
+
+# Editor-based Rest Client
+.idea/httpRequests
+
+# Android studio 3.1+ serialized cache file
+.idea/caches/build_file_checksums.ser
+
+### Intellij+all Patch ###
+# Ignores the whole .idea folder and all .iml files
+# See https://github.com/joeblau/gitignore.io/issues/186 and https://github.com/joeblau/gitignore.io/issues/360
+
+.idea/
+
+# Reason: https://github.com/joeblau/gitignore.io/issues/186#issuecomment-249601023
+
+*.iml
+modules.xml
+.idea/misc.xml
+*.ipr
+
+# Sonarlint plugin
+.idea/sonarlint
+
+### Terraform ###
+# Local .terraform directories
+**/.terraform/*
+
+# .tfstate files
+*.tfstate
+*.tfstate.*
+
+# Crash log files
+crash.log
+
+# Exclude all .tfvars files, which are likely to contain sentitive data, such as
+# password, private keys, and other secrets. These should not be part of version
+# control as they are data points which are potentially sensitive and subject
+# to change depending on the environment.
+#
+*.tfvars
+
+# Ignore override files as they are usually used to override resources locally and so
+# are not checked in
+override.tf
+override.tf.json
+*_override.tf
+*_override.tf.json
+
+# Include override files you do wish to add to version control using negated pattern
+# !example_override.tf
+
+# Include tfplan files to ignore the plan output of command: terraform plan -out=tfplan
+# example: *tfplan*
+
+# Ignore CLI configuration files
+.terraformrc
+terraform.rc
+
+# End of https://www.toptal.com/developers/gitignore/api/go,intellij+all,terraform
+
+# example generated files
+example/test.json

README.md

@@ -0,0 +1,70 @@
+Terraform Vault Backend
+=======================
+
+Terraform HTTP backend that stores the state in a Vault secret.
+
+* Locking
+* Encryption
+* Versioning
+* Authentication with approle
+
+Usage
+-----
+Look for the example/ folder more a more detailed use.
+
+```hcl
+terraform {
+  backend "http" {
+    address = "http://localhost:3000/backend?ref=secret/data/test&encrypt=true"
+    lock_address = "http://localhost:3000/backend?ref=secret/data/test&encrypt=true"
+    unlock_address = "http://localhost:3000/backend?ref=secret/data/test&encrypt=true"
+  }
+}
+```
+`ref` is the path where the state and the lock are going to be stored.
+
+`encrypt` indicates whether the encryption will be enabled or not.
+
+Configure the backend
+---------------------
+
+The backend reads the following environment variables to set behavioral defaults.
+
+`VAULT_ADDR`
+
+Address of the Vault server expressed as a URL and port, for example:
+https://127.0.0.1:8200/.
+
+DEFAULT: "http://127.0.0.1:8200"
+
+`VAULT_TOKEN`
+
+Vault authentication token. Conceptually similar to a session token on a website, 
+the VAULT_TOKEN environment variable holds the contents of the token.
+
+MANDATORY IF VAULT_ROLE_ID and VAULT_SECRET_ID are empty
+
+`VAULT_ROLE_ID`
+
+Role id used for approle authentication flow.
+
+MANDATORY IF VAULT_TOKEN is empty
+
+`VAULT_SECRET_ID`
+
+Secret associated to a role for approle authentication flow.
+
+MANDATORY IF VAULT_TOKEN is empty
+
+`BACKEND_SERVER_PORT`
+
+Port where the backend server will be listening on.
+
+DEFAULT: "3000"
+
+`BACKEND_ENCRYPTION_KEY`
+
+The encryption key used to encrypt the communication between the backend
+server and the Vault server.
+
+MANDATORY if encryption is enabled

example/main.tf

@@ -0,0 +1,21 @@
+// docker run -it -p 8200:8200 vault
+// annotate the token
+
+// export VAULT_ADDR = "http://localhost:8200"
+// export VAULT_TOKEN = paste_the_previous_token
+// export BACKEND_ENCRYPTION_KEY="myscret"
+
+// go run main.go
+
+terraform {
+  backend "http" {
+    address = "http://localhost:3000/backend?ref=secret/data/test&encrypt=true"
+    lock_address = "http://localhost:3000/backend?ref=secret/data/test&encrypt=true"
+    unlock_address = "http://localhost:3000/backend?ref=secret/data/test&encrypt=true"
+  }
+}
+
+resource "local_file" "testfile" {
+  content = "foobar"
+  filename = "${path.module}/test.json"
+}

go.mod

@@ -0,0 +1,10 @@
+module github.com/frieser/terraform-vault-backend
+
+go 1.16
+
+require (
+	github.com/bhoriuchi/go-crypto v0.0.0-20190614232206-6aed78a5c061 // indirect
+	github.com/bhoriuchi/terraform-backend-http v0.0.0-20190615070304-ad22a976cbe3
+	github.com/hashicorp/vault/api v1.1.1
+	github.com/mitchellh/mapstructure v1.4.1
+)