credhub.yml

## This manifest deploys CredHub, a PostgreSQL database server and UAA on one VM.
##
## This deployment is intended for development testing only. You will lose all of your stored data in the event of an issue with the VM or mounted disks.
##
## This manifest assumes that you are deploying with a BOSH Director that has CredHub enabled. If this is not the case, you must replace the values below with ((variable)) syntax with actual values. If you are using BOSH with CredHub enabled, these values will be generated automatically.
##
## You must update the vm_type (currently 'medium') and network name (currently 'west') according to your cloud config. You must also replace the external_ip and uaa_url with an accurate values.
---
name: credhub

releases:
- name: credhub
  version: latest
- name: postgres
  version: latest
- name: uaa
  version: latest
- name: backup-and-restore-sdk
  version: latest
- name: os-conf
  version: latest
- name: bpm
  version: latest

stemcells:
- alias: default
  os: ubuntu-xenial
  version: latest

update:
  canaries: 1
  max_in_flight: 10
  update_watch_time: 10000-200000
  canary_watch_time: 10000-200000

variables:
- name: credhub-encryption-password
  type: password
  options:
    length: 40
- name: credhub-ca
  type: certificate
  options:
    is_ca: true
    common_name: CredHub CA
- name: credhub-tls
  type: certificate
  options:
    ca: credhub-ca
    common_name: ((external-ip-address))
    alternative_names:
    - ((external-ip-address))
    - ((internal-ip-address))
    - 127.0.0.1
- name: database-tls
  type: certificate
  options:
    ca: credhub-ca
    common_name: ((external-ip-address))
    alternative_names:
    - ((external-ip-address))
    - ((internal-ip-address))
    - 127.0.0.1
    - localhost
- name: database-admin
  type: password
- name: uaa-tls
  type: certificate
  options:
    ca: credhub-ca
    common_name: ((external-ip-address))
    alternative_names:
    - ((external-ip-address))
    - localhost
- name: uaa-jwt
  type: rsa
  options:
    key_length: 4096
- name: uaa-users-admin
  type: password
- name: uaa-admin
  type: password
- name: uaa-login
  type: password
- name: credhub-admin-client-password
  type: password
- name: credhub-admin-user-password
  type: password
- name: credhub-mtls-ca
  type: certificate
  options:
    is_ca: true
    common_name: credhub-mtls-ca
- name: jumpbox-ssh
  type: ssh
- name: uaa-encryption-password
  type: password

instance_groups:
- name: credhub
  instances: 1
  vm_type: medium
  azs: [z1]
  stemcell: default
  networks:
  - name: default
    static_ips: [((internal-ip-address))]
    default: [dns, gateway]
  - name: public
    static_ips: [((external-ip-address))]
  jobs:
  - name: credhub
    release: credhub
    properties:
      credhub:
        tls: ((credhub-tls))
        authorization:
          permissions:
          - path: /*
            actors: ["uaa-client:credhub_admin_client"]
            operations: [read,write,delete,read_acl,write_acl]
        authentication:
          uaa:
            url: &uaa-url https://((external-ip-address)):8443
            internal_url: https://localhost:8443
            verification_key: ((uaa-jwt.public_key))
            ca_certs:
            - ((uaa-tls.ca))
          mutual_tls:
            trusted_cas: [((credhub-mtls-ca.certificate))]
        data_storage:
          type: postgres
          username: admin
          password: ((database-admin))
          host: localhost
          port: 5432
          database: credhub
          require_tls: true
          tls_ca: ((database-tls.ca))
        encryption:
          keys:
          - provider_name: int
            key_properties:
              encryption_password: ((credhub-encryption-password))
            active: true
          providers:
          - name: int
            type: internal
      bpm:
        enabled: true

  - name: postgres
    release: postgres
    properties:
      databases:
        address: 127.0.0.1
        port: 5432
        databases:
        - name: credhub
        - name: uaa
        roles:
        - name: admin
          password: ((database-admin))
        tls:
          ca: ((database-tls.ca))
          certificate: ((database-tls.certificate))
          private_key: ((database-tls.private_key))

  - name: uaa
    release: uaa
    properties:
      bpm:
        enabled: false
      uaa:
        url: *uaa-url
        catalina_opts: -Djava.security.egd=file:/dev/./urandom -Xmx768m -XX:MaxMetaspaceSize=256m
        scim:
          users:
          - name: admin
            password: ((uaa-users-admin))
            groups:
              - scim.write
              - scim.read
              - bosh.admin
              - credhub.read
              - credhub.write
          - name: credhub_admin_user
            password: ((credhub-admin-user-password))
            groups:
              - credhub.read
              - credhub.write
        clients:
          credhub_cli:
            override: true
            authorized-grant-types: password,refresh_token
            scope: credhub.read,credhub.write
            authorities: uaa.resource
            access-token-validity: 30
            refresh-token-validity: 3600
            secret: ""
          credhub_admin_client:
            override: true
            authorized-grant-types: client_credentials
            scope: uaa.none
            authorities: credhub.read,credhub.write
            access-token-validity: 3600
            secret: ((credhub-admin-client-password))
        admin: {client_secret: ((uaa-admin))}
        login: {client_secret: ((uaa-login))}
        zones: {internal: {hostnames: []}}
        sslCertificate: ((uaa-tls.certificate))
        sslPrivateKey: ((uaa-tls.private_key))
        jwt:
          revocable: true
          policy:
            active_key_id: key-1
            keys:
              key-1:
                signingKey: ((uaa-jwt.private_key))
      uaadb:
        address: 127.0.0.1
        port: 5432
        db_scheme: postgresql
        tls_enabled: true
        databases:
        - tag: uaa
          name: uaa
        roles:
        - tag: admin
          name: admin
          password: ((database-admin))
      login:
        saml:
          serviceProviderCertificate: ((uaa-tls.certificate))
          serviceProviderKey: ((uaa-tls.private_key))
          serviceProviderKeyPassword: ""
      encryption:
        active_key_label: key1
        encryption_keys:
        - label: key1
          passphrase: ((uaa-encryption-password))

  - name: user_add
    release: os-conf
    properties:
      users:
      - name: bbr
        public_key: ((jumpbox-ssh.public_key))

  - name: bbr-credhubdb
    release: credhub
    properties:
      release_level_backup: true

  - name: database-backup-restorer
    release: backup-and-restore-sdk
    properties: {}

  - name: ca_certs
    release: os-conf
    properties:
      certs: ((database-tls.certificate))

  - name: bpm
    release: bpm
    properties: {}