Fetch ONVAULT script from the vault container

[gartz]

It would be nice to have a way to fetch the ONVAULT script from the vault container, instead of github.

curl -L https://raw.githubusercontent.com/dockito/vault/master/ONVAULT > /usr/local/bin/ONVAULT

To:

curl -L http://local-network-vault-ip:port/ONVAULT > /usr/local/bin/ONVAULT

The security benefit of doing that is, since the ONVAULT is reviewed and it's a trustable script, it will be always the same in the environment that vault is used.

Using a online script is as much trustable as the team developing and releasing it security, as much as I trust on the project and members of it, if it gets lots of users, it will be a good target for hackers.

[pirelenito]

This is a pretty good idea! It would also fix issues that we had in the past of version miss-match between the server and the script.

Any extra thoughts @maxcnunes, @krolow or @esnunes ?

[maxclaus]

LGTM. Please send a PR and we will include that in the next release.

[gartz]

The index.js have the ONVAULT exposed by that URL, I think a quick add to the README.md would be great addition to the project. Guys you're doing a great job! This is so useful!

[gartz]

I'm not very familiar with shell scripts, so what I did here is:

    RUN "Start vault.\n\n" \
        (set -e : ${VAULT_HOST:=$(ip route|awk '/default/{print $3}')} echo $VAULT_HOST; curl -L http://${VAULT_HOST}:14242/ONVAULT > /usr/local/bin/ONVAULT) \
    && chmod +x /usr/local/bin/ONVAULT

In my case, I'm using the default VAULT_HOST and port, but I think it would be nice to allow to configure it in the docker-compose by using command args. This complexity is not necessary on my project, but your project might need such use case.

[llwt]

Used a more simple approach in ours (since we don't need the extra configurability) and it works great!

RUN curl -L "http://$(ip route|awk '/default/{print $3}'):14242/ONVAULT" > /usr/local/bin/ONVAULT &&\
    chmod +x /usr/local/bin/ONVAULT

Another thanks from me for this project, after reading through that massive issue thread in the docker repo it's awesome to have a solid workaround.