Vault Overview

HashiCorp Vault is the single source of truth for every credential in devhome — vCenter/ESXi logins, VM admin passwords, ArgoCD/Rancher tokens, HAProxy certs, and Terraform provider auth. Nothing should ever be hardcoded in a .tfvars, .pkrvars.hcl, or script.

Official download

Vault install/downloads — always current.

Runs on truenas-dr

Vault runs as a Docker container on truenas-dr (see TrueNAS Services), with an unsealer sidecar container that re-unseals it automatically after a restart — which matters, because "restart the Vault container" is a real, sometimes-necessary fix (see Kubernetes Auth).

KV mount layout — devhome

Path	Contents
devhome/vmware	The big one: vsphere_server, vsphere_username, vsphere_password, esxi_host_username, esxi_host_password, esxi_license, vcsa_root_user/vcsa_root_passowrd (typo kept intentionally — matches the live field name), vm_admin_password, haproxy_cert_chain/haproxy_lb_username/haproxy_lb_password/haproxy_root_password, govc_datacenter/govc_insecure. Consumed by all 3 vsphere Terraform roots, every Packer builder, WSL's configure-personal.sh, and Ansible.
devhome/dir_path	truenas_base_path, kubeconfig_base_dir, secrets_base_dir, terraform_state_dir, ssh_key_dir — shared filesystem base paths used to build config/cert directory paths consistently across scripts
devhome/azure	arm_client_id/arm_tenant_id/arm_client_secret/arm_subscription_id, azuredevops_pat/azuredevops_org_service_url, dns_zone/resource_group (the last two were added directly to Vault but aren't wired into terraform/azure/main.tf yet — that file still hardcodes devhome-prod/devhome.cloud, a known gap)
devhome/argocd	argocd_server_addr, argocd_username, argocd_password
devhome/rancher	rancher_url, rancher_admin_password
devhome/packer	build_username, dsrm_password, ssh_password, plus a flat (not nested — Packer's vault() HCL function can't read nested JSON) os_metadata block of Windows image/KMS keys

Packer's vault() function needs a literal /data/ segment

vault("devhome/data/<secret>", "<field>") — KV-v2's API path always has /data/ in the middle, easy to forget when every other consumer's syntax hides it (Terraform's data source, Ansible's lookup plugin, and PowerShell's Invoke-RestMethod calls all take the mount/path separately rather than as one concatenated string).

There is no devhome/vcenter path

A couple of older scripts referenced a devhome/vcenter secret with username/ password fields that never actually existed post-reorg — the real path is devhome/vmware with vsphere_username/vsphere_password. If a script 403s or gets an empty {"errors":[]} response from Vault, check for this exact mistake before assuming a permissions problem.

Reading secrets from Terraform

data.vault_kv_secret_v2 data sources pull these at plan/apply time — see Terraform.

Signing in as a human

Vault's own UI/CLI login is OIDC against Microsoft Entra ID rather than a token/userpass credential — see Vault SSO.