How to Set Up HashiCorp Vault for Production Secrets Management on Linux VPS

Why Hardcoded Environment Secrets Are a Critical Security Liability

In modern software development, applications require access to dozens of sensitive credentials: database connection strings, Stripe payment secret keys, SendGrid tokens, AWS IAM access keys, and SSH private keys. Storing these credentials in plaintext .env files or committing them accidentally to Git repositories is one of the leading causes of enterprise cloud data breaches.

HashiCorp Vault is the industry-standard identity-based secrets management and encryption system. Featuring unified API access, fine-grained access control policies, dynamic on-demand database credentials with automatic time-to-live (TTL) revocation, and audited access logs, Vault eliminates secret sprawling and enforces a strict Zero-Trust security model across your infrastructure.

In this technical implementation guide, we will configure HashiCorp Vault on Ubuntu 24.04/22.04 LTS using high-performance integrated Raft storage, initialize the cryptographic unseal keys, configure systemd daemons, and protect the Vault Web UI behind Nginx SSL.

Step 1: Installing the Official HashiCorp APT Repository

# Install prerequisite tools
sudo apt update && sudo apt install -y gpg curl coreutils nginx certbot python3-certbot-nginx

# Add HashiCorp GPG key
wget -O- https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor -o /usr/share/keyrings/hashicorp-archive-keyring.gpg

# Add official APT repository
echo "deb [signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list

# Install Vault binary
sudo apt update && sudo apt install -y vault

Step 2: Configuring Integrated Raft Storage & Vault HCL

Create dedicated directories with strict security permissions:

# Create storage directories
sudo mkdir -p /var/lib/vault/data /etc/vault.d
sudo chown -R vault:vault /var/lib/vault /etc/vault.d

Create configuration file /etc/vault.d/vault.hcl:

storage "raft" {
  path    = "/var/lib/vault/data"
  node_id = "node1"
}

listener "tcp" {
  address     = "127.0.0.1:8200"
  tls_disable = "true"
}

ui = true
api_addr = "https://vault.example.com"
cluster_addr = "https://127.0.0.1:8201"
disable_mlock = false

Step 3: Starting Systemd Service & Initializing Vault Operator

# Enable and start Vault systemd daemon
sudo systemctl enable --now vault
sudo systemctl status vault --no-pager

# Export environment variable for local CLI
export VAULT_ADDR='http://127.0.0.1:8200'

# Initialize Vault Operator (Generates 5 unseal keys & Initial Root Token)
vault operator init

CRITICAL: Store the generated 5 unseal keys and Root Token in a secure offline password manager. Unseal Vault by providing 3 of the 5 keys:

vault operator unseal <Key_1>
vault operator unseal <Key_2>
vault operator unseal <Key_3>

# Authenticate with Root Token
vault login <Initial_Root_Token>

Step 4: Creating Key-Value Secret Engines (KV v2)

# Enable versioned Key-Value secrets engine
vault secrets enable -path=secret kv-v2

# Store production database credentials securely
vault kv put secret/production/database   host="127.0.0.1"   username="app_user"   password="SuperStrongDatabaseSecret2026!"

# Retrieve credentials via CLI or REST API
vault kv get secret/production/database

Step 5: Nginx Reverse Proxy with SSL for Vault Web UI

Create /etc/nginx/sites-available/vault.example.com:

server {
    listen 80;
    server_name vault.example.com;

    location / {
        proxy_pass http://127.0.0.1:8200;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

Enable the site and issue an SSL certificate:

sudo ln -s /etc/nginx/sites-available/vault.example.com /etc/nginx/sites-enabled/
sudo nginx -t && sudo systemctl reload nginx
sudo certbot --nginx -d vault.example.com

Configuring Dynamic Database Credentials for PostgreSQL

Instead of sharing static database passwords among developers and microservices, Vault can generate temporary, unique database credentials with automatic 1-hour expiration:

# Enable database secrets engine
vault secrets enable database

# Configure connection to PostgreSQL
vault write database/config/my-postgres-database     plugin_name=postgresql-database-plugin     allowed_roles="read-only-role"     connection_url="postgresql://{{username}}:{{password}}@127.0.0.1:5432/app_prod?sslmode=disable"     username="vault_admin"     password="AdminPassword2026!"

# Define dynamic role with 1-hour TTL
vault write database/roles/read-only-role     db_name=my-postgres-database     creation_statements="CREATE ROLE "{{name}}" WITH LOGIN PASSWORD '{{password}}' VALID UNTIL '{{expiration}}'; GRANT SELECT ON ALL TABLES IN SCHEMA public TO "{{name}}";"     default_ttl="1h"     max_ttl="24h"

# Generate new dynamic credentials instantly
vault read database/creds/read-only-role

Automated Raft Snapshot Backups

Schedule daily encrypted Raft storage snapshot backups:

vault operator raft snapshot save /var/backups/vault_snapshot_$(date +%F).snap

Automating AppRole Authentication for CI/CD & Microservices

For automated server-to-server communication without interactive human logins, Vault provides the AppRole authentication mechanism using RoleID and SecretID credentials:

# Enable AppRole auth method
vault auth enable approle

# Create policy for microservices
vault policy write microservice-policy - << 'EOF'
path "secret/data/production/*" {
  capabilities = ["read"]
}
EOF

# Create AppRole and bind policy
vault write auth/approle/role/web-api     secret_id_ttl=24h     token_num_uses=50     token_ttl=1h     token_max_ttl=4h     policies="microservice-policy"

# Retrieve RoleID and SecretID for application environment variables
vault read auth/approle/role/web-api/role-id
vault write -f auth/approle/role/web-api/secret-id

Automated Vault Unseal with Cloud KMS or Systemd

In enterprise deployments, manual unsealing after server reboot is avoided by configuring Auto-Unseal using AWS KMS, Google Cloud KMS, or Transit Vault keys.

Configuring Granular Vault ACL Policies for Multi-Tenant Teams

Enforce strict least-privilege security by creating granular Access Control List (ACL) policies using HashiCorp Configuration Language (HCL):

# Developer Policy: Read-only access to development credentials (/etc/vault.d/developer.hcl)
path "secret/data/development/*" {
  capabilities = ["read", "list"]
}

# DevOps Policy: Full CRUD capabilities on production secrets
path "secret/data/production/*" {
  capabilities = ["create", "read", "update", "delete", "list"]
}

# Apply policies to Vault
vault policy write developer /etc/vault.d/developer.hcl
vault policy write devops /etc/vault.d/devops.hcl

Auditing Vault Access Logs & Compliance Security

Enable cryptographic audit device logging to record every token request and credential read for regulatory compliance: vault audit enable file file_path=/var/log/vault/audit.log.