generalize docker-compose.yml a bit

* rather than generating keys in the 'Dockerfile', which is slow and
  makes the image behave differently from the dev or shipped images,
  just check them in. (obviously do not use these - or any of this
  workflow - in production.)
* same for vault certs, to make vault testing easier.
* move port mappings and '.' mapping to hack/overrides/dev.yml, which is
  now symlinked to docker-compose.override.yml to maintain the previous
  'docker-compose up' dev workflow.

this will make it easier to re-use docker-compose.yml for dev images and
for testing against final images. the aim here is to avoid ha

Signed-off-by: Alex Suraci <suraci.alex@gmail.com>

.gitignore

@@ -10,7 +10,6 @@ web/public/elm.min.js
 web/public/bundle.js
 web/public/*.bundle.js
 web/public/main.css
-docker-compose.override.yml
 *.coverprofile
 *.coverprofile.*
 *.test
@@ -20,6 +19,5 @@ ci/deployments/*/keys/gcp.json
 ci/deployments/*/keys/id_rsa
 ci/deployments/*/keys/id_rsa.pub
 
-hack/vault/certs
 hack/vault/init.json
 worker/runtime/integration/sample/sample

Dockerfile

@@ -4,22 +4,6 @@
 ARG base_image=concourse/dev
 FROM ${base_image} AS base
 
-# generate keys (with 1024 bits just so they generate faster)
-RUN mkdir -p /concourse-keys
-RUN concourse generate-key -t rsa -b 1024 -f /concourse-keys/session_signing_key
-RUN concourse generate-key -t ssh -b 1024 -f /concourse-keys/tsa_host_key
-RUN concourse generate-key -t ssh -b 1024 -f /concourse-keys/worker_key
-RUN cp /concourse-keys/worker_key.pub /concourse-keys/authorized_worker_keys
-
-# 'web' keys
-ENV CONCOURSE_SESSION_SIGNING_KEY     /concourse-keys/session_signing_key
-ENV CONCOURSE_TSA_AUTHORIZED_KEYS     /concourse-keys/authorized_worker_keys
-ENV CONCOURSE_TSA_HOST_KEY            /concourse-keys/tsa_host_key
-
-# 'worker' keys
-ENV CONCOURSE_TSA_PUBLIC_KEY          /concourse-keys/tsa_host_key.pub
-ENV CONCOURSE_TSA_WORKER_PRIVATE_KEY  /concourse-keys/worker_key
-
 # download go modules separately so this doesn't re-run on every change
 WORKDIR /src
 COPY go.mod .

docker-compose.override.yml

@@ -0,0 +1 @@
+./hack/overrides/dev.yml

docker-compose.yml

@@ -4,8 +4,7 @@ services:
   db:
     image: postgres:${POSTGRES_TAG:-latest}
     shm_size: 1gb
-    ports:
-    - 6543:5432
+    ports: [5432]
     environment:
       POSTGRES_DB: concourse
       POSTGRES_USER: dev
@@ -14,13 +13,15 @@ services:
   web:
     build: .
     image: concourse/concourse:local
-    volumes:
-    - .:/src
     command: web
     depends_on: [db]
-    ports:
-    - 8080:8080
+    ports: [8080]
+    volumes: ["./hack/keys:/concourse-keys"]
     environment:
+      CONCOURSE_SESSION_SIGNING_KEY: /concourse-keys/session_signing_key
+      CONCOURSE_TSA_AUTHORIZED_KEYS: /concourse-keys/authorized_worker_keys
+      CONCOURSE_TSA_HOST_KEY: /concourse-keys/tsa_host_key
+
       CONCOURSE_LOG_LEVEL: debug
       CONCOURSE_POSTGRES_HOST: db
       CONCOURSE_POSTGRES_USER: dev
@@ -39,18 +40,17 @@ services:
     command: worker
     privileged: true
     depends_on: [web]
-    ports:
-    - 7777:7777
-    - 7788:7788
+    volumes: ["./hack/keys:/concourse-keys"]
     stop_signal: SIGUSR2
     environment:
+      CONCOURSE_TSA_PUBLIC_KEY: /concourse-keys/tsa_host_key.pub
+      CONCOURSE_TSA_WORKER_PRIVATE_KEY: /concourse-keys/worker_key
+
       CONCOURSE_LOG_LEVEL: debug
       CONCOURSE_TSA_HOST: web:2222
 
       # avoid using loopbacks
       CONCOURSE_BAGGAGECLAIM_DRIVER: overlay
 
-      # so we can reach Garden/Baggageclaim for debugging
-      CONCOURSE_BIND_IP: 0.0.0.0
-      CONCOURSE_BAGGAGECLAIM_BIND_IP: 0.0.0.0
+      # work with docker-compose's dns
       CONCOURSE_GARDEN_DNS_PROXY_ENABLE: "true"

hack/keys/authorized_worker_keys

@@ -0,0 +1 @@
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAAgQC5M/8SZG0sSpf48enWEvQlfZc4lrAp18LnKerC0zkxizh21dDXYsaThTr7BQ7BbsvKgyjANP8IRgKfs+lZPKTBvhd9MujNFQCTT6xt4QUzFl/PoBHeGkECCjfEwb/hoX58iFTMQitRROO5Ep2B7g4XZqDrrZpVqCm+yGtHDkog0w==

hack/keys/session_signing_key

@@ -0,0 +1,15 @@
+-----BEGIN PRIVATE KEY-----
+MIICXAIBAAKBgQDN4RQ1Bykd9mx8QxPfgMvzPvBeuklTYzLV9cLoIze4E/JQfN3T
+7exHlRUF8GGZ7mQ8wQFMCTdrQDo8YD/+UVvRsGBkpfZBDHTaRxyENyNZ3Tx3AIkG
+XLLH5X+sjCVd3RS35Rr24iSENYz5oThiwIEAckjvVnT5Gr26r/FB5E3YMQIDAQAB
+AoGAQF+8fcg7Zw8CZOhkcmJHY0uuxS/idZxy7MvnocZBSeGSxvAEPJwMYWWQKUc8
+fXE5DnYa/bd0CKkQjIhb+h1eY+ali0kPmfpCCeNMiBe6sVt7RCvSUuW33QLvpiN3
+UDJakgpFGKGOqtKMsaZ55znjLtKRXs2IFSMhJkN8BIy9pXECQQDWSjB9y0BFKBk8
+9YWBGMc5ceUh3V6VF29I4yOFvC/cVl5SAzGLzyKxnuLzxfcKXW3LRH4wupProyHJ
+JBgR6ltjAkEA9fPMvCUrIWWWcqktIXGMhCbrh1crwHn7SA2BcMfHStDIv7o9SKZ6
+iRVDXJmTlzoZzSSBjS5xovUaEWXfmxf0WwJALCHBVNbcGKIGeJhz8z9gIEOFlfDa
+PshBwfgNY8h67tzWtfs0Y/+3vG7lfKDjnL3bE8a6WlzCg//nwF3vmxjx0wJBAJxd
+F/9RXf9Id4KD/ZYye1QU7k5H5B/lLRTcyTsrN49f9xC1VXrXpDV8mCvJ02QkYvzh
+xZ89NK+WRbFj4+nVK9sCQE6/QPbvYPhlxmMZPHBP592claknyV+nrslmJUcLoD8V
+AcWGRM8bfaq0tDTJ2qoYENCgwsTa+NLJ53rsS1DQqDw=
+-----END PRIVATE KEY-----

hack/keys/setup

@@ -0,0 +1,10 @@
+#!/bin/bash
+
+set -e -u
+
+cd $(dirname $0)
+
+concourse generate-key -t rsa -b 1024 -f session_signing_key
+concourse generate-key -t ssh -b 1024 -f tsa_host_key
+concourse generate-key -t ssh -b 1024 -f worker_key
+cp worker_key.pub authorized_worker_keys

hack/keys/tsa_host_key

@@ -0,0 +1,15 @@
+-----BEGIN PRIVATE KEY-----
+MIICXgIBAAKBgQDfDOx3ah4y48Zg7Q3356vFP343Czsbaaj8XO5HbY4FflPP2Ph8
+29781lgahvouzk5o7//p3ZRNJR0rk1e5OshZqdt+S5uvBPmlO/COJBwhazOtPhv+
+5po5PZcIVOQy6sbfyyloYNOTnzMWrWirKhbZ+5NJY9yT/UgoHGjpI2wJAwIDAQAB
+AoGBAM8BuIhPJT3HpToZZ6hXC1Thy2qccrvLQPkN6lrCM1en2XMCBAQlLvtqlpPw
+B0rfT2gWrWTHrzY1pq/lbDnNc1gANuZp2VQ87KhQVIteOEWExg0m0tImbwjRNq5L
+UY/jGR9i4fuAAazf75kKYpa8KzFMAxyI0hYpsvTgdplYx+hxAkEA8eaYS/BTShKQ
+j5gUWIoqGVLa0xOCXmTEI2Au2d9pGjnF0DUzqXYQvQXQN85ks27Dj5byAUbgaUUL
+jMeuVZ9U6QJBAOwNEEDVSqQIINhzncHf0vVrDEDrLgR9THW7MXBYb5KEAhYNv5LB
+Vtns5Cn8im0aRRGOFxkekmZpfLzWAZ6mawsCQQC7dSqCdrvkxBw42u6xamiTdUzU
+k+LMiaQhkfDcsC//vdOYtRHS+gagpPelt5D8KBLunFfwO1++1F3N/BQSkEW5AkBT
+kaRpb5nHTOFkADqfwsALBuUFrr1R9ZI2NBmiroyBkJ60dBWYvT4kVQvKGZBgY+aD
++owO5pXqD/qLWDCmnEBVAkEA6RIezo0y1PSXrKVvRa5xoSkmVh7HZCtZ7HcNUc6n
+z94wM/gJmgOuXVcfmdmwmkMfHYqX8c0gCXVtasXiWGNuNg==
+-----END PRIVATE KEY-----

hack/keys/tsa_host_key.pub

@@ -0,0 +1 @@
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAAgQDfDOx3ah4y48Zg7Q3356vFP343Czsbaaj8XO5HbY4FflPP2Ph829781lgahvouzk5o7//p3ZRNJR0rk1e5OshZqdt+S5uvBPmlO/COJBwhazOtPhv+5po5PZcIVOQy6sbfyyloYNOTnzMWrWirKhbZ+5NJY9yT/UgoHGjpI2wJAw==

hack/keys/worker_key

@@ -0,0 +1,15 @@
+-----BEGIN PRIVATE KEY-----
+MIICXQIBAAKBgQC5M/8SZG0sSpf48enWEvQlfZc4lrAp18LnKerC0zkxizh21dDX
+YsaThTr7BQ7BbsvKgyjANP8IRgKfs+lZPKTBvhd9MujNFQCTT6xt4QUzFl/PoBHe
+GkECCjfEwb/hoX58iFTMQitRROO5Ep2B7g4XZqDrrZpVqCm+yGtHDkog0wIDAQAB
+AoGAZXCNbU2EXpYc10Xphk+rWj2H7n7azpBXOLZE16FJ2lEfBDfow5Beo759p7AF
+fP1qselVELH2Xlm6Zi7syOvmcSeHaWF2l7yvwH7UDC6kB5iqcAjl1VghCEs0DJVg
+TcIkoPChyFuoxX4voBodmMbDoTyxnyK+ZyOo0SG8a9NP5gECQQDAVjKFU6sZWMK+
+NvtraJtUBX8T7LJwciaD1CVqEZRj0cdiAqFMb59Rd1TMloHNcyduVRg7vnbcVM/P
+RfzbMTOhAkEA9oFT+Lj0M9tpT6S5ITpNRUbMGhwrKhOME3O2jZ5rHp7SUtxJrEwI
+ZQmzc6EyMH3lpBCFFDG5Aw9hHpchH3G/8wJAAiUz/Q642tiFm4+LcGBDU0WYbEV4
+nA555YCJRkyZ5h8h5TL4T5zzHvqAxKNtITiGmRFz6r6uHrkHdF1oe51p4QJBALXp
+gvqOI0kRponr2eM3j0aMlJrAJuqKOlkwj4u7WPnj4vrbLlNEWP2XRyMR1mQKxKlq
+t4rLluk3NEjK5tq5qxkCQQCjkc9HVC9RM0maAn31qOGZ0vgRQzjMXldHsY760vCi
+Lzh7KHxe9iPL6I98uxHFq6XtcY+N5BqB7To114s6gcg0
+-----END PRIVATE KEY-----

hack/keys/worker_key.pub

@@ -0,0 +1 @@
+ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAAAgQC5M/8SZG0sSpf48enWEvQlfZc4lrAp18LnKerC0zkxizh21dDXYsaThTr7BQ7BbsvKgyjANP8IRgKfs+lZPKTBvhd9MujNFQCTT6xt4QUzFl/PoBHeGkECCjfEwb/hoX58iFTMQitRROO5Ep2B7g4XZqDrrZpVqCm+yGtHDkog0w==

hack/overrides/dev.yml

@@ -0,0 +1,18 @@
+version: '3'
+
+services:
+  db:
+    ports: [6543:5432]
+
+  web:
+    ports: [8080:8080]
+    volumes:
+      - .:/src
+
+  worker:
+    ports:
+    - 7777:7777
+    - 7788:7788
+    environment:
+      CONCOURSE_BIND_IP: 0.0.0.0
+      CONCOURSE_BAGGAGECLAIM_BIND_IP: 0.0.0.0

hack/vault/certs/concourse.crt

@@ -0,0 +1,25 @@
+-----BEGIN CERTIFICATE-----
+MIIEIzCCAgugAwIBAgIRAJ1wqk1Wpx2xbqZMaoABJ0kwDQYJKoZIhvcNAQELBQAw
+EzERMA8GA1UEAxMIdmF1bHQtY2EwHhcNMjEwMTIyMTgzOTI2WhcNMjIwNzIyMTgz
+OTI0WjAUMRIwEAYDVQQDEwljb25jb3Vyc2UwggEiMA0GCSqGSIb3DQEBAQUAA4IB
+DwAwggEKAoIBAQDSTZwEj/hGN3yeFmamYkPoW9vcOCBt5mBc7RWK4FWAQe2sp3o6
+8Kqt4j7/zeR41XIZKU4taa+ficXYGhxW8VsDARxjXBYMcuAZvkRntpgkV+3XZ+2/
+aEq2fa2tYyaNETCyziwRSfPzXfylI7bpVg7h1tZwP8V/4nzE0GIBZMkiGqb8ppCL
+tlkGhu+it3pwkgq1Tq+iA/WYlOA7eXpTvcpMoPB0BbT+W9M0VXEPWo8ppJ8dj7V6
+11ttOROTSDhmNfCISQAkbyPeQN3bOWXw1jSN4n7E2Tk+6MFZ4hHxn91o+5QR89R3
+/g724VYp28bNu+4Am3qujlRYPuO3S6XcesWDAgMBAAGjcTBvMA4GA1UdDwEB/wQE
+AwIDuDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwHQYDVR0OBBYEFFNm
+Yc0W+UevtbA1oTmpm8hwciNMMB8GA1UdIwQYMBaAFGN05DOBJZTMVU06x+kkI/Qj
+b9CxMA0GCSqGSIb3DQEBCwUAA4ICAQDJh3v0FPu1duzZEwuVzUxEaEClXv7izf5o
+A0ON2uhF3C07brYxpL+3sfZIkLoS9k9FYKmp9/phw/zZbpNoBkYOY5Vmky7Ilq0J
+SbJN/4YODS84ihnBxrJ1c2OxrKi7UdDuwff5SNWvWxOHyHGZM0BZlcwI2WwWDtwv
+1cKJeY9fNXmK45IPolEJo8CZlNRvnODZiOBVR4pECZfaM15O1puU0/V6oc9EuLYv
+Tr1UBcOvVF+9ir7A0aOi25AYAcaqy/m37eo4fQYq6Tp7jJhAQrLFHC0o4VOcMkGc
+zp19eYXzEzhxGG9tmnSoUythVGBwqz+i4GendcAzQd45S5uANiMHEzEEZNNHl4AY
+V00Dzj4tH8aLpoon2BzqM97XFrzVk80tvdcBjG7NJ0OjczrejlEhIulLYeFhBUC1
+I7Cs6UYWEQWqjo79heK+iQVm2hJxnyuekyu4zSPEwU9FksnZQL7X8aptC9HPg+v9
+LYAGRtDdS07WnJYbXnE9r7nXIkvg8uEtcyli3r2dQ0D6bQVZGroZc4l1gABs7ifE
+D5Xr50k4VR7vZzKLpuA+WpIaGFlwiMscdHNwmW0vtMVEFVtsgwa4lso9RYtLXfLu
+J5cbLvZQ+9rBj6nN+uVBIWBVlnHkzZsN4LGK7BQ5nihtwPMxe/M5kPFoSC5aAyEe
+EWny6DBidw==
+-----END CERTIFICATE-----

hack/vault/certs/concourse.csr

@@ -0,0 +1,15 @@
+-----BEGIN CERTIFICATE REQUEST-----
+MIICWTCCAUECAQAwFDESMBAGA1UEAxMJY29uY291cnNlMIIBIjANBgkqhkiG9w0B
+AQEFAAOCAQ8AMIIBCgKCAQEA0k2cBI/4Rjd8nhZmpmJD6Fvb3DggbeZgXO0ViuBV
+gEHtrKd6OvCqreI+/83keNVyGSlOLWmvn4nF2BocVvFbAwEcY1wWDHLgGb5EZ7aY
+JFft12ftv2hKtn2trWMmjREwss4sEUnz8138pSO26VYO4dbWcD/Ff+J8xNBiAWTJ
+Ihqm/KaQi7ZZBobvord6cJIKtU6vogP1mJTgO3l6U73KTKDwdAW0/lvTNFVxD1qP
+KaSfHY+1etdbbTkTk0g4ZjXwiEkAJG8j3kDd2zll8NY0jeJ+xNk5PujBWeIR8Z/d
+aPuUEfPUd/4O9uFWKdvGzbvuAJt6ro5UWD7jt0ul3HrFgwIDAQABoAAwDQYJKoZI
+hvcNAQELBQADggEBAHiwZvjW/b8uuw3aliC2aUi/Z+BiUk3PVFYRKi6ht516vvWM
+gvh6DMNo/23/amEbmSli4NfMHjl53Wya/TLDvPznr0DBD68GJ+3ibbUZEaWzrmFY
+7fUTlHn4gYKEdolozLeleTeCEYLhYiO9CnRpSzvN2B4cC9Xx1KKHj6+TpLIpYTF/
+h0p5dKYLitGPn09kEjaU2XtdBmEMoifHBzWF1MfoiR4zqCoFuxxAI39gNEyIpRdZ
+oV1dspd8A+4D1nnfGIj/PY+9bAcPHVLd6XRV7YYzjm9ZvSD28L9TsPy+B/LyUNAQ
+oancGhZWIkVwSbxqVbKQD3eCUaAz79Ew63TPOJM=
+-----END CERTIFICATE REQUEST-----

hack/vault/certs/concourse.key

@@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEogIBAAKCAQEA0k2cBI/4Rjd8nhZmpmJD6Fvb3DggbeZgXO0ViuBVgEHtrKd6
+OvCqreI+/83keNVyGSlOLWmvn4nF2BocVvFbAwEcY1wWDHLgGb5EZ7aYJFft12ft
+v2hKtn2trWMmjREwss4sEUnz8138pSO26VYO4dbWcD/Ff+J8xNBiAWTJIhqm/KaQ
+i7ZZBobvord6cJIKtU6vogP1mJTgO3l6U73KTKDwdAW0/lvTNFVxD1qPKaSfHY+1
+etdbbTkTk0g4ZjXwiEkAJG8j3kDd2zll8NY0jeJ+xNk5PujBWeIR8Z/daPuUEfPU
+d/4O9uFWKdvGzbvuAJt6ro5UWD7jt0ul3HrFgwIDAQABAoIBACKOkDGLur9HBNox
+UiLLCN+YoJMaQfHtJi5+4shUPph5vOVfC829mD5EbBe6rG1SnZIW4HrD4BD2IaV1
+/Owocs0WlKSbECBxi/OO+UyVi4CFVlbMBBwstgIwuqZAIaiSh48KI+GfZk+6RPaZ
+3MeQ1Zc0pz4ArKJsBBaPK1uRRR+uNyZYs0IuJYJmwbXH/5e10ffkB4O+esch118P
+zhcpU3ACSqsnulvbK083kzvHdYKmMBmxFuRyY06TwjX40WkvDo3H0iOg1UZE4awC
+GkjrSQgqOBIHFkFcezkwYQ96Kg5NAZoZZrP78KI9TrCm91vwC+CqGKs2E+FMTofM
+qidQ8bECgYEA3ZZ5VDMMVWfc55C/wbRpO1otNuuPgXHOhge4bW8HSpI5ZbIQYMNu
+KlQgvH9rYi83FoMG94s+/bd+7OHaBrPr4mT+H47fms3zamQyv5mPZ1wRRzfU3GyC
+l857dgAQM5aJ42z1Fg3Y+uGcWecItFYKcJCpEJYACSjheWpB5sWDIrkCgYEA8vZ/
+7IXkegneioSOKlMBniGUNYPMCnh87sFb/gNSPQo2mm++2vSlXYJzvN++dcoC+E+T
+o63PwrGjBq2+v4UQXfGyAHm5cpjGBhGxCkD9HBU8x4gXrrSefOWTxRijDHDVxa4f
+mfB2+1si+CxYK8Nfn7MUWlPrnsIayVzFPKE4/BsCgYBZlR7h8m1XDdFZ8MQFTKmK
+bC+BV4RBwb/Loc1muI9LD4iS24URiZC9HhvJ+P1xyULNIBWt+CZ0Lj3rCHe7Y/vG
+ICw4l+tAS2jQJ0f4+9zk3WzCzQiKQHgfZUO2ddoW8RI31nHTA7An5RPvqJ51QZ+g
+2GrxIKNNELDvBA02fb1BSQKBgGMN6mOkxtyWb3trxYYt50fwCruyqxpNuymf/YBX
+HE00f8SA8H/WJCE2kTccxUrCfGl+EAQ4Va7bu0p6xXzRpDWY12hoOBonfPx2dAZp
+LognhGsY6gbZLpBfDNrbS4ZD7nO0pL+fEPMzWdNySNQ2yCKU4SReeH52RnN39hXc
+6R2nAoGAZ0iP+zjoI952lVEVA5btfWRs70gNGHcEhwU/+p2mcXUhglEnvgUmn1NB
+ixjHFtbS/TCKJ6HiSZ7HcTDSZam+bsPBTugn91x/GGSD2OWcbIhIKQ/YB6XTvQek
+qVQ4Q3VLTBxwncy54eGEE9iWIndkuB7M9rRQXZdfCrpUdzNpIiw=
+-----END RSA PRIVATE KEY-----

hack/vault/certs/vault-ca.crl

@@ -0,0 +1,16 @@
+-----BEGIN X509 CRL-----
+MIICgjBsAgEBMA0GCSqGSIb3DQEBCwUAMBMxETAPBgNVBAMTCHZhdWx0LWNhFw0y
+MTAxMjIxODM5MjZaFw0yMjA3MjIxODM5MjVaMACgIzAhMB8GA1UdIwQYMBaAFGN0
+5DOBJZTMVU06x+kkI/Qjb9CxMA0GCSqGSIb3DQEBCwUAA4ICAQAO77ibAscsZ6bU
+mScKO12zVdo/m3ndmhMyZBo7MXcsY7ugVvTMefeNjnmrhPmiUAda9bWL4da1b6cm
+psJmmpv91tCMxWURQGwq6nOeMyO+WSOi43QnPZAVUANKqG9mIW4UuhMUgR7r3BDD
+PcyDyHBRqumB7JCclfbP/gtexOgnF6UXGqqxEeGZk5gGKIkvJfL0uyRueLgWGMTQ
+6TjAj8S1UnEX9Uu6dJY8fqXGUxtRPBLaV+SXPtRmcXd2mWuf/jzy7CbF2Bcc/jJ6
+m+wFzCXEUx6izGmL4acDOr6cgxwZCr1nq1nIYVv7UwGDhOnfklCXqv1/8kLlLJAg
+Y311c5tx3Ir0f2YeRMUalO9TKFAgZCwYdQKFM1u32Qqmdc0nRvhljuP2JFybnk4I
+9+eUedQnP1KXDVe8u8DFaYJRF2rqGRgcTjsamWqMCFT3iay//JxleMqZyKI7fqaq
+NQLzzWiBgh/SQUOP8brPFMheSs3h7Ht5Tx/JQzyJRZwjOt0Bh1iA2nr+n0a2GAnK
+h2oobD/bneClY8Oq++3N4ccT/Fewnl0w448Kj9dBfwWnIxNTzjFYKkmSb6Q7TbGb
+vDnXovI1bozrlsyi6aYQDLYGMqczxCuWKQy5d1e6juNK2ILPbSwi1u2w0qSpwyfu
+aR1ITBS2Rr/WU/4qaqtYLa/hOsdhdA==
+-----END X509 CRL-----

hack/vault/certs/vault-ca.crt

@@ -0,0 +1,29 @@
+-----BEGIN CERTIFICATE-----
+MIIE5jCCAs6gAwIBAgIBATANBgkqhkiG9w0BAQsFADATMREwDwYDVQQDEwh2YXVs
+dC1jYTAeFw0yMTAxMjIxODM5MjZaFw0yMjA3MjIxODM5MjVaMBMxETAPBgNVBAMT
+CHZhdWx0LWNhMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA1ulTj0EH
+z42xXuPq6W9nF7JbOppU/ClZ8AE65kyDf9FO8sLPuwOuTlU0J+Lzv+MqdGvBbtD6
+5/1vuK0AIsRYzdFxhUMhxa1fNRqbRKjNaSi0UQzqEnEoo89AM4d2gfYBVmTsaXut
+Wvfs50XB3enGyzjpJHLVyNF9rAlCwAK2/1oSzsnqgNe0bi+xLdOLa4m2mX95bcHr
+lwGsy/vt2clV1akn5A47RAKrj1pulij7BFQXzXvZiGjexgd3eCNqk/QkW1hzH1YE
+6zHcirMCHvsgLBfaJ00SCIQtoty9ANbAhRMwR96zZtXPzO0/xQhJec2Ku7DfTLdj
+VnJpSM+l+ywzxdOzmEl4yi1XMi4MtrszKd5rirexotqPnV+cbyeGacYmjOvC8NOV
+UH3aSsmHyiQf88AI138GsmX7kx8HirM6OfWgMrxAu3MYX618kcsUy8mUgjaw67Oc
+xHQ0O+TOisaubAc63vQDa50wvUeqZW11jSZnycnBLIJmPiR7cgrVcOjHjciXvtwz
+/8OYXSjjxpkSJVllNKwEL3571hLylbvXdRAMfwNH839pH5Y9LTnzqFCWRHx22tlB
+hK/M4MLj2Yl6uiO6VMyxvndTM9n254ktaolPUtWhyt516mpSsW0n7HgeId9AnKhk
+ibghD3SgMSeP4ZwqchIqhwsMbtnUJVwKXBUCAwEAAaNFMEMwDgYDVR0PAQH/BAQD
+AgEGMBIGA1UdEwEB/wQIMAYBAf8CAQAwHQYDVR0OBBYEFGN05DOBJZTMVU06x+kk
+I/Qjb9CxMA0GCSqGSIb3DQEBCwUAA4ICAQDHrIGezaIkLsqEKPZL3H33eJN/oAtw
+O/h97ndVAH9dYbI1+KJEIX5grPX+PaqjRqC3LpHEf94lAExWT2aLeVFX0sN9ZJd5
+DQXQ2dM1DUWzGZShtTDjaHo/WOIMYb7hBbCB6phvgMBrUSjPsZIrKJZjIlqVxRDx
+8n0e+qcze9TpLIXPRVE3tTMuGJHR0zMiYaEwPdcC1DC1QQSWXaFCGE0uiT97MvjV
+oOWGLo2Lkx4hs8xsoZwBQJf8AVPWhzAKg38P/3rPOInXuDHh+OiWHovpIUXagAiT
+xWOS6hgUU5AY1g4KrHxbsLndSqfiMZILJ6VjtLFw062pG0AbHSSde9CGxrXDXoFV
++yLjFKbUCeF7cq3l9/b2ex3LfVUzjYcrHjH88msfzPy5SdvjWecp5Wa0+7xORrdB
+sCOE597IXWqwr9lt9AHkjiAu6xNXNudRg5P3mrhjB7bo1gEKRaR6TMafB+71WjiL
+CYCM4nD9BFmYf97Rb/vV93d2S0niFaIt2llFNRyaHDAXTPkbBW7cs0RbnNg+nDlP
+UmVmhtovlNns5JCFSd3j1pT/ASvdIKRZS/rhxN4bWvoPedC6hN+gjFseSn4QEAeO
+N2XX6R4rz7DOCz/uZD9kDCdNO512QlBhRs+p/hGNJT0unq/zLZOYmmLQXQHQA59Y
+4twKs7I0aiuZqQ==
+-----END CERTIFICATE-----

hack/vault/certs/vault-ca.key

@@ -0,0 +1,51 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIJKAIBAAKCAgEA1ulTj0EHz42xXuPq6W9nF7JbOppU/ClZ8AE65kyDf9FO8sLP
+uwOuTlU0J+Lzv+MqdGvBbtD65/1vuK0AIsRYzdFxhUMhxa1fNRqbRKjNaSi0UQzq
+EnEoo89AM4d2gfYBVmTsaXutWvfs50XB3enGyzjpJHLVyNF9rAlCwAK2/1oSzsnq
+gNe0bi+xLdOLa4m2mX95bcHrlwGsy/vt2clV1akn5A47RAKrj1pulij7BFQXzXvZ
+iGjexgd3eCNqk/QkW1hzH1YE6zHcirMCHvsgLBfaJ00SCIQtoty9ANbAhRMwR96z
+ZtXPzO0/xQhJec2Ku7DfTLdjVnJpSM+l+ywzxdOzmEl4yi1XMi4MtrszKd5rirex
+otqPnV+cbyeGacYmjOvC8NOVUH3aSsmHyiQf88AI138GsmX7kx8HirM6OfWgMrxA
+u3MYX618kcsUy8mUgjaw67OcxHQ0O+TOisaubAc63vQDa50wvUeqZW11jSZnycnB
+LIJmPiR7cgrVcOjHjciXvtwz/8OYXSjjxpkSJVllNKwEL3571hLylbvXdRAMfwNH
+839pH5Y9LTnzqFCWRHx22tlBhK/M4MLj2Yl6uiO6VMyxvndTM9n254ktaolPUtWh
+yt516mpSsW0n7HgeId9AnKhkibghD3SgMSeP4ZwqchIqhwsMbtnUJVwKXBUCAwEA
+AQKCAgBrBJeKn4x/K4TmxsJE6ifBIhzRyuaFByZ1IHevFOzqqlURCDefXg7fjQhC
+0H4m0L1kagBR6Zj4CzkmEmgd5/58x04rWSmpIVNmw1AMWa6oLg/UyISLGHRvVhYX
+Ut6Niu5RkkIzqNXDlfAPnqoSkoZezoEymEijDsbw80+dA/0SnUz+UogHDuMXd4JY
+Wp5zt4kJWPQj1sw1Ty04CsT/jYXDts9Zfki+7kF2SkcFWXTeS+3qckD575b3r+Ir
+Hh/Fe27bWelB8njSkerL2qY0vULhEiOdLIDNYtzC2/72Ovp1if+h2mEl1VT8LCx0
+NlM4Z0Utf79CmZPLCYAqNNTnhbRlZTv6Ex9bV7teXJe7fpQ9l0P5svM5IGk1LcNb
+vTGeIINu8W49DQTgBZRp/ST82CxhjhjloFmorc06MrDhI9krObEEkbpMVmDj6cfd
+jXeygnkMAYCbH1iAdKl9Uj6altd08CYSwzXLQgTytQljNnFQQSCMma4xuzUiqu8R
+zCIeJFafy1vNYFxDyLgztJdvJ/r7BoVvIRcHV/OLiHltd98535wukqOnjhW0x5GJ
+A0952OnXIqO1l26/OXr1lmJCRci/TGhSBoKxvFyjJtoyvDP2uuXWWZ8QKVfltEi9
+Zay8X0WfhMh2qIXYhhP7a8yOhy66I+UCRhXBV1suU1xGyciGxQKCAQEA/0b1ipiX
+eLwtKdKkIfQV5I1kHGMoqb367eF6GW560Bu/nV06AUUhgRNXHxVJmsYscpgFMzEF
+FcKd0N7OJAEbl4AcUt5OHbqA1RXPTojyjsQnyBSsy+d/eZy1cO7em/YDBsZ7Gq8l
+mtDy1uTCe/5LiTA/ys5kt8Z559TFf71PhiAFXRG4drrLwNuoc/Y652cwTo6WzKD4
+DB9WRQUgcE95Z/XkiB8Y4M387Gq7R9rUXF16a34zPNSB5DgS4GH4yM6xZEE4nmz0
+ghfld5GXlceRU5k2U4gcNqkllSv+BuZjoGR8NKAEtQ9dXFCfR/zGUeUhSF99RxPv
+V9mCPB8IILrXQwKCAQEA14UbjjTDpQdpdKq3d+7+bHYWjMWHvaFHBMqwZaYyI5T/
+/VUenaWbqsrkn7Nh+UWe5oD1ngqGKqAUdLCeFhqmj+tXFRca8GaBO8p5bfgz3KVk
+1lLJU6Iphbw2m3Dvb7oFHXSAJCjqBSpHYqDAHh6aGkfhhW7t93yl/xc8CcnxmBWE
+b2rgt/+rcN0plMfdC13i8wj24tR6Q9RfZDWwdmkmIIunvUsd1PcYfLLuCVgBSIsH
+a8NNtrurNh8jfMR4omaKX9qEhweT3OlKIwC+RzuPZ0yARtlKLpa0j+HWe+G9Nh++
+K0ZNP72Oui152SCwWGoYgCrEAjXPSLtA6DVSJiztxwKCAQEA21QoW3BHlGB5nVlx
+1ApXVQt2XD2GDnFAS2pS8c7OjkeJFremwriW1MO9MuOjXeuu/LZIoXcYm12fInqM
+OrsI7d4Qd9Kw4zH+xxX6C8v2O1ulom7BGGBKUj6mVeWmNfHlH8kgtAiQErg8LQ5X
+Wxld5P0jkihKuOs6iklxdxM8ZEzWzuQOzVQpBAa2cQu6CF/MTXKNdjtHY4L5KEwD
+Vvuxn/TQ6XNueJgDG02Io3AMzV8zc2/2rekXwPG8pjUG/+E24KB4+QU7/xpw+Y6J
+4xKYdm9JEfP76aris4wcsej46DHt1Xk3EimlWU+bysoPywVG11vT02H5Xk1vbCBt
+Z1Gg6QKCAQBDRElYdkGGNa0Fe+8toMuKQMVDBLgcSMUoyraJ03icwHmxsSqQG8td
+YFxBODThH4i7+w4uWKyNi083KJT+4yyPiO2yKHcBB41YgxapaymMuZaiik5KKzf4
+hMkqdPJWleHY0q7YGmkIWazULMYp4HVKtJrAEeJ2N1J8Lt1PVNdyF20xdVNUOplg
+7bZ3uHXWgWQ/ZNHh9F2A5D0twtAj9SewSsZ8/3/9I25iJVrEUdJ8uOAFE30jBqom
+h0uFOrFIRubzifmJR6Uv8yRvjmDVTNKydB8pfdJ4fhM3QU63dbqftQKe8R9VQK3W
+kDESwvAneF3TSwXIhtD+q2tTzqioP6erAoIBAGhmcwWMgRiCjmv3ZsTGiF62A24p
+P6X7yVEQDTO3E+NGOzmsGbZxPfi07eGlM5Fxig3wD3pXRy4UBguQkO0i+ymQg3Tq
+yD6AFx1k1mROnwXyZf8Ll9BSguGQH4/HV/uc2z3XvYr4zq2949Z4pc8Rn3mXkPkT
+0D8Bjv7LZtQh7KQC7C6V7Q/PLJN5S8tSLGiB8RDBtopB3MiXBc0KVZcy8pifH7sX
+Rgz1ZVcfdbxjz7VOax0r+dV8oo368oZ03/pZLfeh9D4HJCYFg9Ni+Fg1wty+OezW
+NnyPgz3k9TSa/6uiKsO4hrsFJKBELY49oADuO5ILsZkuR4xxqQN7NOlNi+M=
+-----END RSA PRIVATE KEY-----

hack/vault/certs/vault.crt

@@ -0,0 +1,25 @@
+-----BEGIN CERTIFICATE-----
+MIIEODCCAiCgAwIBAgIQeBIGeS+jW9geM/JGJFA2rDANBgkqhkiG9w0BAQsFADAT
+MREwDwYDVQQDEwh2YXVsdC1jYTAeFw0yMTAxMjIxODM5MjZaFw0yMjA3MjIxODM5
+MjRaMBAxDjAMBgNVBAMTBXZhdWx0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
+CgKCAQEA7QSQvt3nAvguOTFVvr0nrcECXoJQcZarL1QqXNrSwFA2tsmhH/m/fcfK
+8hQBz82IWz+658ozqgY6UrroLFwr2cQbWbMsWEAyeb51kWb+1QvA0dhMaJMxMTHD
+qUgbfFGlhsv9YGW0QzGyr0EDTCvyOxXLbKH3NE5pWA/28VlpIs1K2jkayyKz6bd3
+NsnICsg52TMvFAKkulEUR0kAEaJifAiHmADKO2nEcS+K9oieppMLXbTLWuxhkcIm
+l7ORxu6OEH3fZ+N/i4BWBuuFqtlvMu2Jrbbumi+uGTzcsdfgwmt21DH566NGqTol
+7/a+hnvX1Vfkz38Mc1yFIYKurEsAMQIDAQABo4GKMIGHMA4GA1UdDwEB/wQEAwID
+uDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwHQYDVR0OBBYEFK7zsfL+
+C3+JXPZBNRue1zcMsx6kMB8GA1UdIwQYMBaAFGN05DOBJZTMVU06x+kkI/Qjb9Cx
+MBYGA1UdEQQPMA2CBXZhdWx0hwR/AAABMA0GCSqGSIb3DQEBCwUAA4ICAQDGesxV
+Gnzqt1dj4opUD+HWrXA5yXIuwz7uJp+mSF5hTFV3gFQK4vOAlQRf6XNTujsZn4kM
+GyxU7smUJn7I7egmdA323mCS9Puliz14/L1H/EeVfOX3/5VIodaqkpxpXxxwVP9V
+xz3uEGGVO9VX9U2KS3pUqfUFywmDD2adJsw+B1hX5uaYTamA9PBEhM5HRVD4l2zh
+eiQiFL2oMyns04Y3O+511V04FbKrnif1QFx+x+JhqD41I+VyTbiHGhoqNvPKOQwW
+vyPXQuLDRF0/bj3pgPkefck+a3dQBXJ1KeQyX/AWXqM3AzNoTA/e+ztQ/yTnu/rM
+ZTMMulIu6qTXy480JOHy8b1EyW80hjzoBrcsBdfYfSLSEc1LuTZTyPY80qP3c9Bw
+MMtyxIGBcsoBb0qMe36EVk3i/FKjM3Wnb2BHX0Hx615ZK+XskRngWc/n7sydzSJG
+mEzGrPaSm6dSrPSnLqsBJptJCcKtgngwSAkwKoj0ydrNMrIXfQwG8WZa9EQTCUPi
+3XcwdnQhA/lGCc9QRcZkqD3t6Jqnm94NSsOHU0WXqiK3tSVG/+rIfHBVDt3sWrGP
+btcJ3t9sWhWevStWUhd1by3V1h8BTnAapNGITzvMWxqRYcjdlBvYxF1PPHQm67OY
+trsmaUpbAg03tW8PMEdHqzhA+7JRSVcibCYXSw==
+-----END CERTIFICATE-----

hack/vault/certs/vault.csr

@@ -0,0 +1,16 @@
+-----BEGIN CERTIFICATE REQUEST-----
+MIICfjCCAWYCAQAwEDEOMAwGA1UEAxMFdmF1bHQwggEiMA0GCSqGSIb3DQEBAQUA
+A4IBDwAwggEKAoIBAQDtBJC+3ecC+C45MVW+vSetwQJeglBxlqsvVCpc2tLAUDa2
+yaEf+b99x8ryFAHPzYhbP7rnyjOqBjpSuugsXCvZxBtZsyxYQDJ5vnWRZv7VC8DR
+2ExokzExMcOpSBt8UaWGy/1gZbRDMbKvQQNMK/I7Fctsofc0TmlYD/bxWWkizUra
+ORrLIrPpt3c2ycgKyDnZMy8UAqS6URRHSQARomJ8CIeYAMo7acRxL4r2iJ6mkwtd
+tMta7GGRwiaXs5HG7o4Qfd9n43+LgFYG64Wq2W8y7Ymttu6aL64ZPNyx1+DCa3bU
+Mfnro0apOiXv9r6Ge9fVV+TPfwxzXIUhgq6sSwAxAgMBAAGgKTAnBgkqhkiG9w0B
+CQ4xGjAYMBYGA1UdEQQPMA2CBXZhdWx0hwR/AAABMA0GCSqGSIb3DQEBCwUAA4IB
+AQB0nEN2f6+mJpzepF+bHG3Rnt/8SkzZKUijGqFAzxq+6UZzK+52L4cg1TSZFSOT
+xWuYPJrUwucPw43+pPhenfMoL/NODPskxo3H96jwkUu4FUCJPwckP1bUTzrdmu0L
+YactxvQkvx/TUCpJxiOybuYpobDqKJnrBkdkiQjye6wYRv7Bcqv56EdCY5+K1utq
+V4iSg76ESj/witt5c7gXW6lsTrQHv6IuZMPob/6lHs+ZoS1H9nkceegX3O8kWOJz
+Al5W2aenjAt+KKjyM5bN9BI9ehJVucrwMttEr/rH8C+Y9ipR12reeXJaW7urHp8C
+RAmQpVgOx5MPY7jE4EuzhLS0
+-----END CERTIFICATE REQUEST-----

hack/vault/certs/vault.key

@@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEogIBAAKCAQEA7QSQvt3nAvguOTFVvr0nrcECXoJQcZarL1QqXNrSwFA2tsmh
+H/m/fcfK8hQBz82IWz+658ozqgY6UrroLFwr2cQbWbMsWEAyeb51kWb+1QvA0dhM
+aJMxMTHDqUgbfFGlhsv9YGW0QzGyr0EDTCvyOxXLbKH3NE5pWA/28VlpIs1K2jka
+yyKz6bd3NsnICsg52TMvFAKkulEUR0kAEaJifAiHmADKO2nEcS+K9oieppMLXbTL
+WuxhkcIml7ORxu6OEH3fZ+N/i4BWBuuFqtlvMu2Jrbbumi+uGTzcsdfgwmt21DH5
+66NGqTol7/a+hnvX1Vfkz38Mc1yFIYKurEsAMQIDAQABAoIBABVxSUsLNkANhdkE
+vpYf9LwCbx1vuqlcESaZ/a8i2NgvKZQFz77d0FYnwhN+fd9337Mpo9Yec+gY4iPj
+5udEe28bD8JgtE1TmX1sHqTF5Z4OjyYs5FS9pECoGORyspHfrRLx131mFhXSJDE4
+t3ynqSVxRlMQoBWqVltyLkwNY7aTIXVF/lkT8p7Pvr6CV7hAdh0Pz6tZj+Nw6H1+
+5R4U4MXS7GBa/erhLOO4bznkQnYJaILPuFKWadxdKsA7NqqTsUJLCxjklzmev+x0
+hPbL3uZXuWLUTu2WFewv4m8YVPmdwHe5hpaZxd0jdxx8zS3b/azbXB8uTeknvCLZ
+x25gwZUCgYEA+BPVC3gCjOz11sGlAsDpmGzijdaSxH+WkDZF+Qr8CfCFc8Uj4z6p
+rKqwcQx97JMvVagmj5uunC48gOwwMBkuofu3ykRd6aFX2fA2KHgvRuyDpTAGz8Mx
+6PhH2ywA1A7jEcxtWg08jEll0Xe/INGAmREbMrUvhrEZC0EmLFQv8PsCgYEA9JZQ
+j1fcw9yo3K3rHmGnFqCxUOw1v6FTzKFsnQamZTV44P3aFX7BDYDsYtO9vOaIml5I
+oBQYv5zRShK1jvAZIlsj5AFhvjvD0HLqq5hEyhhyG6XmRpFYYLqibG5yqJ4r8qHe
+hH0bRtW7tTuOdelvU6C+W+WdlWmXks7Kr6yCg8MCgYAwsLvM73YYsN2jlAhOHQz8
+NMrWqfnOhXhIv85GDijfzoxy54ueq4rj7/CHj7sbdtwAhOtknlrMHqsTZsgieJ7V
+fjFZisef9mHmzaXjlYs58Wv5PQ7pMleWcTyxQNa8yFs7ABOqbBSpODK6xTUHPPdv
+k5LyBevZFONkeRoD81YhhwKBgGDDt0t+r1Ct1AC6rfJvH/PLz1r8mKcf5E9o7deR
+8fLInPImfElUxHvbLapLqx0494JbGtB6IvBr0kFD9aB/TPJSrHhgM5NXgbjOPhl1
+PIHX+g0GLXxttFFQhUHw0Fv1d92ePLKd7FSx6nlg/pOXrvue9LDWvumFxPnH5lhq
+H5iRAoGAaZ1NbZxYRaeT9IB/AwT861C6pWqjKRvT6+ABUioptUl4+y8SBDODL3C7
+nWSsWAG363mqjKaxVF1q4iizhgg064bhe8IwckAal0NHIOMirluVC50DVMW1Od7G
+ul+e3w+T8dUVcGsORuYWFZIXtuEx4EqB23iGwCK+W866qi3VkP8=
+-----END RSA PRIVATE KEY-----