Feat: Vault Integration

[pozgo]

[v0.3.0] - 2025-01-19

Added

HashiCorp Vault Integration

• Vault Secrets Management: Store and retrieve SSH keys, servers, environment variables, and bash scripts from HashiCorp Vault KV v2 secrets engine
• Create Resources in Vault: Store new SSH keys, servers, env variables, and scripts directly to Vault via API
• Dual Source Support: Use both local SQLite database and Vault simultaneously
• Source Badges: Visual indicators (Local/Vault chips) showing where each resource originates
• Storage Selector: Choose storage location (Local or Vault) when creating new resources
• Vault Status Indicator: Real-time connection status displayed in the header
• Connection Testing: Built-in Vault connection test in Admin Panel
• Vault Settings Panel: Configure Vault address, token, and mount paths in Admin Panel

Security Enhancements

• Audit Logging: Optional JSONL audit log for command executions, script runs, and security events
• SSRF Protection: Vault address validation blocks cloud metadata endpoints (169.254.x.x) while allowing private IPs for self-hosted Vault
• Path Traversal Protection: Vault secret paths validated to prevent directory traversal attacks
• Error Sanitization: API errors sanitized to prevent information leakage (no internal IPs, paths, or stack traces)
• Startup Validation: Authentication configuration validated at startup - server fails fast if auth enabled but credentials missing
• Configurable Timeouts: All HTTP, SSH, Vault, and command execution timeouts configurable via environment variables

UI/UX Improvements

• Group Management: Organize SSH keys, servers, env variables, and scripts in groups with autocomplete
• Group Filtering: Filter resources by group in Admin Panel
• SSH Key Selection in Terminal: Dropdown shows SSH keys from both Local and Vault with source badges

Documentation

• Reorganized Documentation: README simplified with detailed docs moved to docs/ directory
• docs/CONFIGURATION.md: Complete configuration reference (env vars, config files, timeouts)
• docs/SECURITY.md: Comprehensive security guide (auth, TLS, SSRF, audit logging)
• docs/DEPLOYMENT.md: Deployment guides (Docker, systemd, production checklist)
• docs/DEVELOPMENT.md: Development setup and contributing guide
• docs/VAULT_SETUP.md: HashiCorp Vault setup and configuration guide

Changed

• README.md: Simplified to focus on quick start with Docker Compose, links to detailed documentation
• Config Package: Added timeout configuration methods and audit log path support
• Server Package: Now validates auth config at startup and uses configurable timeouts
• Validation Package: Added Vault address, path, and secret name validators

Security

• Fixed potential SSRF vulnerability in Vault integration
• Added path traversal protection for Vault secret paths
• API errors no longer expose internal details (IP addresses, paths, stack traces)
• Added configurable timeouts to prevent DoS attacks

New API Endpoints

Vault Resource Creation

• POST /api/vault/ssh-keys - Create SSH key in Vault
• POST /api/vault/servers - Create server in Vault
• POST /api/vault/env-variables - Create environment variable in Vault
• POST /api/vault/bash-scripts - Create bash script in Vault

New Environment Variables

Variable	Default	Description
READ_TIMEOUT	30s	HTTP read timeout
WRITE_TIMEOUT	600s	HTTP write timeout
IDLE_TIMEOUT	60s	HTTP idle timeout
VAULT_TIMEOUT	30s	Vault operation timeout
COMMAND_TIMEOUT	300s	Command execution timeout
SSH_CONNECT_TIMEOUT	30s	SSH connection timeout
AUDIT_LOG_PATH	(disabled)	Path to audit log file