VaultAPI

Lightweight API to store/retrieve secrets to/from an encrypted Database

Platform Supported

Deployments

Kick off

Recommendations

• Install python 3.10 or 3.11
• Use a dedicated virtual environment

Install VaultAPI

python -m pip install vaultapi

Initiate - IDE

import vaultapi.server


if __name__ == '__main__':
    vaultapi.server.start()

Initiate - CLI

vaultapi start

Use vaultapi --help for usage instructions.

Environment Variables

Sourcing environment variables from an env file

By default, VaultAPI will look for a .env file in the current working directory.

Mandatory

• APIKEY - API Key for authentication.
• SECRET - Secret access key to encode/decode the secrets in Datastore.

Optional (with defaults)

• TRANSIT_KEY_LENGTH - AES key length for transit encryption. Defaults to 32
• TRANSIT_TIME_BUCKET - Interval for which the transit epoch should remain constant. Defaults to 60
• DATABASE - FilePath to store the secrets' database. Defaults to secrets.db
• HOST - Hostname for the API server. Defaults to 0.0.0.0 [OR] localhost
• PORT - Port number for the API server. Defaults to 9010
• WORKERS - Number of workers for the uvicorn server. Defaults to 1
• RATE_LIMIT - List of dictionaries with max_requests and seconds to apply as rate limit. Defaults to 5req/2s [AND] 10req/30s
• ALLOW_PUBLIC_IP - Boolean flag to allow connections via public IP. Defaults to false
• ALLOW_PRIVATE_IP - Boolean flag to allow connections via private IP. Defaults to false
• ALLOW_PRIVATE_IP_RANGE - Boolean flag to allow connections via any private IP address (1-256) within range. Defaults to false

Optional (without defaults)

• LOG_CONFIG - FilePath or dictionary of key-value pairs for log config.
• ALLOWED_ORIGINS - Origins that are allowed to retrieve secrets.
• ALLOWED_IP_RANGE - IP range that is allowed to retrieve secrets. (eg: 10.112.8.10-210)

Checkout decryptors for more information about decrypting the retrieved secret from the server.

Auto generate a SECRET value

This value will be used to encrypt/decrypt the secrets stored in the database.

CLI

vaultapi keygen

IDE

from cryptography.fernet import Fernet
print(Fernet.generate_key())

API Functionality

Endpoint	Description	API method
/health	API health endpoint	GET
/get-secret	Retrieve secrets (comma separated list)	GET
/get-table	Get ALL the secrets stored in a table	GET
/list-tables	List all available tables	GET
/put-secret	Store or update a secret (key-value pairs)	PUT
/delete-secret	Delete a specific secret	DELETE
/create-table	Create a new table	POST
/delete-table	Deletes an existing table	DELETE

Coding Standards

Docstring format: Google
Styling conventions: PEP 8 and isort

Release Notes

Requirement

python -m pip install gitverse

Usage

gitverse-release reverse -f release_notes.rst -t 'Release Notes'

Linting

pre-commit will ensure linting, run pytest, generate runbook & release notes, and validate hyperlinks in ALL markdown files (including Wiki pages)

Requirement

python -m pip install sphinx==5.1.1 pre-commit recommonmark

Usage

pre-commit run --all-files

Pypi Package

https://pypi.org/project/VaultAPI/

Docker Image

https://hub.docker.com/r/thevickypedia/vaultapi

Runbook

https://thevickypedia.github.io/VaultAPI/

License & copyright

© Vignesh Rao

Licensed under the MIT License