Graphical interface for Hashicorp Vault
npm install vault-ui
title="Vault-UI" width="64px" align="right" />



A beautiful way to manage your Hashicorp Vault

- Easy to deploy as Web App
- Desktop version works on Mac, Linux and Windows
- Material UI Design
- Integrated JSON Editor
- Written in React
Vault-UI Desktop is available for the following operating systems:
- Windows
- MacOS
- Linux (32bit and 64bit AppImage)
Download the latest version from the release page and install/run the software
Vault-UI can be deployed as a shared web app for your organization
Docker images are automatically built using an automated build on Docker Hub.
We encourage that versioned images are used for production.
To run Vault-UI using the latest Docker image:
``bash`
docker run -d \
-p 8000:8000 \
--name vault-ui \
djenriquez/vault-ui
#### Advanced configuration options
By default, connection and authentication parameters must be configured by clicking on the configuration cog on the login page.
Using environment variables (via docker), an administrator can pre-configure those parameters.
Example command to pre-configure the Vault server URL and authentication method
`bash`
docker run -d \
-p 8000:8000 \
-e VAULT_URL_DEFAULT=http://vault.server.org:8200 \
-e VAULT_AUTH_DEFAULT=GITHUB \
--name vault-ui \
djenriquez/vault-ui
Supported environment variables:
- PORT Sets the port for Vault-UI to listen on. (Default 8000)CUSTOM_CA_CERT
- Pass a self-signed certificate that the system should trust.NODE_TLS_REJECT_UNAUTHORIZED
- Disable TLS server side validation. (ex. vault deployed with self-signed certificate). Set to 0 to disable.VAULT_URL_DEFAULT
- Sets the default vault endpoint. Note: protocol part of the url is mandatory. Example: http://10.0.0.1:8200VAULT_AUTH_DEFAULT
- Sets the default authentication method type. See below for supported authentication methods.VAULT_AUTH_BACKEND_PATH
- Sets the default backend path. Useful when multiple backends of the same type are mounted on the vault file system.VAULT_SUPPLIED_TOKEN_HEADER
- Instructs Vault-UI to attempt authentication using a token provided by the client in the specified HTTP request header.
This defaults can be overridden if the user fills out the endpoint and auth method manually.
Current supported login methods:
- GITHUB : When using the GitHub backendUSERNAMEPASSWORD
- : When using the Username & Password or RADIUS backendsLDAP
- : When using the LDAP backendTOKEN
- : When using the Tokens backend
Current supported management of backend auth methods:
- GitHub
- RADIUS
- AWS-EC2
- Username & Password
- Token
- AppRole
In some cases, users might want to use middleware to authenticate into Vault-UI for purposes like SSO. In this case, the VAULT_SUPPLIED_TOKEN_HEADER may be populated with the name of the header that contains a token to be used for authentication.
#### JSON
`json`
{
"path": {
"auth/token/lookup-self": {
"capabilities": [
"read"
]
},
"sys/capabilities-self": {
"capabilities": [
"update"
]
},
"sys/mounts": {
"capabilities": [
"read"
]
},
"sys/auth": {
"capabilities": [
"read"
]
}
}
}
#### HCL
`
path "auth/token/lookup-self" {
capabilities = [ "read" ]
}
path "sys/capabilities-self" {
capabilities = [ "update" ]
}
path "sys/mounts" {
capabilities = [ "read" ]
}
path "sys/auth" {
capabilities = [ "read" ]
}
`
Secrets also are accessible directly by key from a browser by navigating to the URI /secrets/. For example, if you have a generic secret key of /hello/world/vault using the _generic_ mount secret/, one can navigate to this directly through http://vault-ui.myorg.com/secrets/secret/hello/world/vault.
#### Root key bias
By default, secrets will display as their raw JSON value represented by the data field in the HTTP GET response metadata. However, users can apply a "Root Key" bias to the secrets through the settings page. The "Root Key" will be used when reading, creating and updating secrets such that the value displayed in the UI is the value stored at the "Root Key". For example, if the secret at secret/hello is { "value": "world" }, setting the "Root Key" to value will update the UI such that the secret will display as simply "world" instead of { "value": "world" }.
#### JSON:
`json`
{
"path": {
"auth/token/accessors": {
"capabilities": [
"sudo",
"list"
]
},
"auth/token/lookup-accessor/*": {
"capabilities": [
"read"
]
}
}
}`
#### HCLhcl
path "auth/token/accessors" {
capabilities = [ "sudo", "list" ]
}
path "auth/token/lookup-accessor/*" {
capabilities = [ "read" ]
}
`
sh
./run-docker-compose-dev
`If major changes are made, be sure to run
docker-compose build to rebuild dependencies.$3
The following will spin up a Vault UI server only. It will not set up
Vault for you:
`sh
yarn run dev-pack &
yarn start
``