TPM/TXT auto-unseal
**Is your feature request related to a problem? Please describe.** HSMs are expensive and require Vault Enterprise. KMS solutions only work in the cloud. TPM-based auto-unseal would allow for auto-unseal based on measured boot. **Describe the solution you'd like** Vault should support unsealing via a TPM. **Describe alternatives you've considered** None **Explain any additional use-cases** This would be useful for those who want to run Vault on a bare-metal server, especially individuals for whom the cost of an HSM and/or Vault Enterprise would be difficult to justify. In home lab situations, automatic unseal after power outages is important. **Additional context** It would also be nice if the TPM could be used for the server certificate or (more likely) for decrypting its secret key.
Posted by DemiMarie on Dec 27, 2020, 5:44 AM
Tags
Related issues
- > I had the opinion that it'd be too expensive for developers to support offline mode, peer to peer, or community servers after shutdown ...
- "Best build quality" is the most important part.
- Historically that rarely happens because industrial equipment is/was generally too expensive for the average worker to purchase on t...
- I can see why they wanted to change the "RISC-V is inevitable" line.
- The GB10 itself is pretty good and I love using mine for broad Linux development.
- > Nothing stops someone from taking the free Windows Vivado and making it run on Linux The EULA and the fact that the linux versior runs...
Raise real-world problems, find people facing the same issue, and discuss solutions.3,000 issues0 comments
pricing (Sysadmin)
> I had the opinion that it'd be too expensive for developers to support offline mode, peer to peer, or community servers after shutdown ...
"Best build quality" is the most important part.
Historically that rarely happens because industrial equipment is/was generally too expensive for the average worker to purchase on t...
I can see why they wanted to change the "RISC-V is inevitable" line.
The GB10 itself is pretty good and I love using mine for broad Linux development.
> Nothing stops someone from taking the free Windows Vivado and making it run on Linux The EULA and the fact that the linux versior runs...
Hetzner has some docs: https://docs.hetzner.com/robot/dedicated-server/ip/additiona...
> too expensive for our internal server needs; not the right fit for our datacenter partners/customers You and me both.
TPM/TXT auto-unseal
**Is your feature request related to a problem? Please describe.** HSMs are expensive and require Vault Enterprise. KMS solutions only work in the cloud. TPM-based auto-unseal would allow for auto-unseal based on measured boot. **Describe the solution you'd like** Vault should support unsealing via a TPM. **Describe alternatives you've considered** None **Explain any additional use-cases** This would be useful for those who want to run Vault on a bare-metal server, especially individuals for whom the cost of an HSM and/or Vault Enterprise would be difficult to justify. In home lab situations, automatic unseal after power outages is important. **Additional context** It would also be nice if the TPM could be used for the server certificate or (more likely) for decrypting its secret key.
Comments (0)
No comments yet. Start the discussion.