minor updates and fixes

loki/CHANGELOG.md

@@ -1,3 +1,9 @@
+0.0.10
+
+* Documentation updates
+
+---
+
 0.0.9
 
 * Updates for tls-client-validation to be working with temp certificates via sftp at first

loki/README.md

@@ -39,7 +39,7 @@ The VAULTSERVER parameter is the IP address of the ```vault``` server to authent
 
 The VAULTTOKEN parameter is the issued token from the ```vault``` server.
 
-The SFTPUSER and SFTPPASS parameters are to create a user with SSH private keys, where you will need to export the private key to the host systems for follower nodes.
+The SFTPUSER and SFTPPASS parameters are for the user on the ```vault``` leader in the VAULTSERVER parameter. You need to copy in the id_rsa from there to the host of this image.
 
 # Explanation
 

vault/CHANGELOG.md

@@ -1,3 +1,9 @@
+2.0.35
+
+* Updating consul agent to tls-client-validation
+
+---
+
 2.0.34
 
 * Switch to using jo to generate json files for vault certificate payload.json. Minor fixes.

vault/vault.sh

@@ -829,12 +829,13 @@ path \\\"pki_int/tidy\\\" { capabilities = [\\\"create\\\", \\\"update\\\"] }
 \\\"node_name\\\": \\\"\$NODENAME\\\",
 \\\"data_dir\\\":  \\\"/var/db/consul\\\",
 \\\"dns_config\\\": {
- \\\"a_record_limit\\\": 3,
- \\\"enable_truncate\\\": true
+  \\\"a_record_limit\\\": 3,
+  \\\"enable_truncate\\\": true
 },
-\\\"verify_incoming\\\": false,
+\\\"verify_incoming\\\": true,
 \\\"verify_outgoing\\\": true,
 \\\"verify_server_hostname\\\": false,
+\\\"verify_incoming_rpc\\\":true,
 \\\"ca_file\\\": \\\"/mnt/certs/combinedca.pem\\\",
 \\\"cert_file\\\": \\\"/mnt/certs/cert.pem\\\",
 \\\"key_file\\\": \\\"/mnt/certs/key.pem\\\",
@@ -843,9 +844,9 @@ path \\\"pki_int/tidy\\\" { capabilities = [\\\"create\\\", \\\"update\\\"] }
 \\\"encrypt\\\": \$GOSSIPKEY,
 \\\"start_join\\\": [ \$CONSULSERVERS ],
 \\\"service\\\": {
-\\\"name\\\": \\\"node-exporter\\\",
-\\\"tags\\\": [\\\"_app=vault\\\", \\\"_service=node-exporter\\\", \\\"_hostname=\$NODENAME\\\"],
-\\\"port\\\": 9100
+  \\\"name\\\": \\\"node-exporter\\\",
+  \\\"tags\\\": [\\\"_app=vault\\\", \\\"_service=node-exporter\\\", \\\"_hostname=\$NODENAME\\\"],
+  \\\"port\\\": 9100
 }
 }\" > /usr/local/etc/consul.d/agent.json
 
@@ -1362,10 +1363,11 @@ cluster_addr = \\\"https://\$IP:8201\\\"
  \\\"a_record_limit\\\": 3,
  \\\"enable_truncate\\\": true
 },
-\\\"verify_incoming\\\": false,
+\\\"verify_incoming\\\": true,
 \\\"verify_outgoing\\\": true,
 \\\"verify_server_hostname\\\": false,
-\\\"ca_file\\\": \\\"/mnt/certs/combindca.pem\\\",
+\\\"verify_incoming_rpc\\\":true,
+\\\"ca_file\\\": \\\"/mnt/certs/combinedca.pem\\\",
 \\\"cert_file\\\": \\\"/mnt/certs/cert.pem\\\",
 \\\"key_file\\\": \\\"/mnt/certs/key.pem\\\",
 \\\"log_file\\\": \\\"/var/log/consul/\\\",