How rehonor/zero-trust-postgres-vault works
This repository is an educational zero-trust PostgreSQL lab. The main workflow authenticates the demo client to Vault with AppRole, obtains short-lived database credentials, then connects to PostgreSQL over verified TLS. Separate branches provide a read-only monitoring dashboard and on-demand log alerts; a runnable insecure baseline supports before/after comparison. The README documents these system-level links; sampled source confirms client, dashboard, and alert behavior, but not every deployment detail.
Main entry points: init.sql PostgreSQL · dashboard/app.py Read-only dashboard · vault-setup.sh Vault · app/app.py Demo client
Components 13
Identity and credentials
- Demo client
app/app.py - Vault
vault/vault-setup.sh - Identity policies
vault/policies
Database security
- PostgreSQL
postgres/init.sql - TLS certificates
scripts/gen-certs.sh - Monitor schema
postgres/monitor.sql
Monitoring and dashboard
- PostgreSQL audit logs
postgres - Read-only dashboard
dashboard/app.py - Alert report
scripts/monitor.py
Baseline comparison
- Insecure baseline
baseline/run.sh
Other components
- Demo operator
- Dashboard viewer
- Baseline operator
Connections 14
- Demo operator → Demo client: runs commands
README.md - Demo client → Vault: authenticates; requests credentials
README.md - Vault → PostgreSQL: creates and revokes users
README.md - Demo client → PostgreSQL: queries over TLS
README.md - Identity policies → Vault: limits identities
README.md - TLS certificates → PostgreSQL: signs certificate
README.md - Dashboard viewer → Read-only dashboard: views panels
README.md - Read-only dashboard → Vault: authenticates; requests credentials
README.md - Read-only dashboard → PostgreSQL: runs restricted queries
README.md - Monitor schema → PostgreSQL: restricts monitoring access
- PostgreSQL → PostgreSQL audit logs: writes audit logs
README.md - PostgreSQL audit logs → Read-only dashboard: read-only mount
README.md - PostgreSQL audit logs → Alert report: feeds log analysis
README.md - Baseline operator → Insecure baseline: runs comparison
README.md