Vault and Secrets Management (CredentialAPI)

This section describes how to enable and manage Secrets management in a Reemo OnPrem environment deployed via Ansible.

Overview

The Reemo secrets management infrastructure relies on three complementary services:

  • CredentialAPI: the interface through which internal services access secrets, whether they come from the internal Vault or from an external Vault.

  • Portal Credential: exposes an mTLS HTTPS endpoint allowing application containers to retrieve their credentials automatically and securely at startup.

  • Vault: stores application secrets (passwords, API keys, certificates) in an encrypted and centralized manner.

Architecture

┌─────────────────────────────────────────────────┐
│  Reemo application containers                   │
│  Retrieve their credentials at startup          │
│  via mTLS + ephemeral key pair + temporary      │
│  Vault token                                    │
└────────────┬────────────────────────────────────┘
             │ HTTPS mTLS (port 8446)
             ▼
┌─────────────────────────────────────────────────┐
│  Portal Credential                              │
│  mTLS auth via Reemo PKI                        │
│  Encrypted credential retrieval                 │
└────────────┬────────────────────────────────────┘
             │ Internal HTTPS
             ▼
┌─────────────────────────────────────────────────┐
│  CredentialAPI                                  │
│  (Vault token stored as Docker secret)          │
└────────────┬────────────────────────────────────┘
             │ HTTPS (TLS)
             ▼
┌─────────────────────────────────────────────────┐
│  HAProxy (stable URL: reemo_vault)              │
└────────────┬────────────────────────────────────┘
             │
   ┌─────────┼─────────┐
   ▼         ▼         ▼
┌──────┐ ┌──────┐ ┌──────┐
│vault1│ │vault2│ │vault3│   (Raft cluster, optional)
└──────┘ └──────┘ └──────┘