ign8vault
Spin up a production HashiCorp Vault + Consul stack in minutes — Hetzner Cloud VPS, Cloudflare DNS, Let's Encrypt TLS, and daily restic backups to Hetzner StorageBox.
pipx install ign8vault
ign8vault quickstart # full step-by-step guide
Quickstart
1. Install
pipx install ign8vault
2. Configure
ign8vault setenv
Walks you through every credential interactively with hints on where to find each value. Writes a .env file in the current directory. Run it again after provisioning to fill in VAULT_ADDR and VAULT_TOKEN.
| Variable | Where to get it |
|---|---|
IGN8_DOMAIN |
Your base domain, e.g. example.com |
IGN8_ADMIN_EMAIL |
Your email — used for Let's Encrypt notifications |
IGN8_HETZNER_TOKEN |
console.hetzner.cloud → Project → Security → API Tokens |
IGN8_CLOUDFLARE_TOKEN |
dash.cloudflare.com → Profile → API Tokens (Zone:DNS:Edit) |
IGN8_CLOUDFLARE_ZONE_ID |
Cloudflare dashboard → select domain → Overview → right sidebar |
IGN8_STORAGEBOX_HOST |
Hetzner StorageBox hostname — optional, skip for no backups |
IGN8_STORAGEBOX_PASSWORD |
Hetzner account → StorageBox details |
3. Provision
ign8vault up
Creates a Hetzner VPS, Cloudflare DNS records (vault.<domain> + consul.<domain>), installs Consul + Vault + nginx + TLS, and sets up daily backups. Credentials are saved to .ign8vault/vault-init.json — keep the unseal keys safe.
4. Finish configuration
ign8vault setenv
Re-run setenv to fill in VAULT_ADDR and VAULT_TOKEN from .ign8vault/vault-init.json. Existing values are preserved.
5. Create users (optional)
ign8vault adduser <username>
Creates a Vault userpass account and a scoped SSH-signing token. Use the printed token as VAULT_TOKEN for ign8vault sign.
6. Sign your SSH key
ign8vault sign
Generates an ed25519 keypair in ~/.ssh/signedssh/ and signs it via the Vault SSH CA. Re-run any time to renew (8-hour validity by default).
7. Configure a target host
ign8vault setupsshd --host <ip> --user <user> --password <pw>
Installs the Vault CA public key on the host, reloads sshd, and adds a ~/.ssh/config entry. After this, ssh <alias> works with your signed cert — no passwords, no per-host authorized_keys.
8. Connect
ssh <alias>
Tear down
ign8vault destroy
Deletes the Hetzner server and Cloudflare DNS records.
Commands
| Command | Description |
|---|---|
ign8vault up |
Provision the full stack |
ign8vault adduser <name> |
Create a Vault user + SSH-signing token |
ign8vault sign |
Create/sign the SSH keypair |
ign8vault setupsshd |
Configure a host to trust the Vault CA |
ign8vault setenv |
Write Vault env vars to shell profile |
ign8vault quickstart |
Print this guide in the terminal |
ign8vault destroy |
Tear it all down |
State
All local state is stored in .ign8vault/:
keys/— server provisioning SSH keypairvault-init.json— root token + unseal keys (chmod 600, keep safe)state.json— Hetzner server ID (used bydestroy)
Signed SSH keys live in ~/.ssh/signedssh/ and are separate from the provisioning state.
After a reboot
Vault requires 3 of the 5 unseal keys after every restart:
vault operator unseal # run 3 times with different keys
1 maintainer
Metadata
1 maintainer
Release files for ign8vault 2.0.10
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | Actions |
|---|---|---|---|---|
| ign8vault-2.0.10.tar.gz | 20.7 kB | Without provenance | Details for ign8vault-2.0.10.tar.gz |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Actions Reset |
|---|---|---|---|---|
| ign8vault-2.0.10-py3-none-any.whl | Python 3 | none | any | Details for ign8vault-2.0.10-py3-none-any.whl |
Total release size: 43.1 kB
Release files / ign8vault-2.0.10.tar.gz
| Download URL | ign8vault-2.0.10.tar.gz |
|---|---|
| Size | 20.7 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
6bb14b1c0cfb21cd8604f830c7f1e64116180293022c0b795b5dd339e91635e5
|
|
BLAKE2b-256 checksum How to use checksums |
14f37c3d7879b43af11816c97ec1f7c2d56ecb754dfff9e5705a11af7945dafd
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
poetry/2.3.4 CPython/3.14.4 Darwin/25.4.0
|
Release files / ign8vault-2.0.10-py3-none-any.whl
| Download URL | ign8vault-2.0.10-py3-none-any.whl |
|---|---|
| Size | 22.5 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
4741e2d8c34a136e4afb12b1b3eb699ee7a143c4ed7beff246142ea35ac86241
|
|
BLAKE2b-256 checksum How to use checksums |
4399dd3dc6730c64686f2b29ee5668f0d524de78260d1560784d489e7e586c00
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
poetry/2.3.4 CPython/3.14.4 Darwin/25.4.0
|
Security for ign8vault 2.0.10
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
No provenance found
None of the files in this release were uploaded with provenance metadata.
A note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.
