From 008ca51fec3a19a3d2f864f449c3fc8399a78f0c Mon Sep 17 00:00:00 2001
From: Jake Lundberg <grove.mountain.github@nym.hush.com>
Date: Mon, 11 Jun 2018 12:42:14 -0700
Subject: [PATCH 1/2] add-pki-guide: updating readme

---
 secrets/pki/vagrant/.gitignore                |   5 +
 secrets/pki/vagrant/CONTRIBUTING.md           |  71 ++++
 secrets/pki/vagrant/DCO                       |  36 ++
 secrets/pki/vagrant/LICENSE                   | 202 ++++++++++
 secrets/pki/vagrant/MAINTAINERS               |   3 +
 secrets/pki/vagrant/NOTICE                    |   5 +
 secrets/pki/vagrant/README.md                 | 186 +++++++++
 secrets/pki/vagrant/Vagrantfile               | 145 +++++++
 secrets/pki/vagrant/demo/clean_demo.sh        |  13 +
 secrets/pki/vagrant/demo/default_env.sh       |  61 +++
 secrets/pki/vagrant/demo/demo-magic.sh        | 200 ++++++++++
 .../demo/demo1_bootstrap_environment.sh       | 103 +++++
 secrets/pki/vagrant/demo/demo2_short_ttls.sh  |  38 ++
 secrets/pki/vagrant/demo/demo3_renew_lease.sh |  24 ++
 secrets/pki/vagrant/demo/demo4_revoke_cert.sh |  14 +
 .../demo/demo5_consul_template_renew.sh       |  39 ++
 .../demo/tokens/short-ttl-hashidemos-com      |   4 +
 .../pki/vagrant/demo/vault_demo_functions.sh  | 361 ++++++++++++++++++
 secrets/pki/vagrant/run_me_first.sh           | 152 ++++++++
 19 files changed, 1662 insertions(+)
 create mode 100644 secrets/pki/vagrant/.gitignore
 create mode 100644 secrets/pki/vagrant/CONTRIBUTING.md
 create mode 100644 secrets/pki/vagrant/DCO
 create mode 100644 secrets/pki/vagrant/LICENSE
 create mode 100644 secrets/pki/vagrant/MAINTAINERS
 create mode 100644 secrets/pki/vagrant/NOTICE
 create mode 100644 secrets/pki/vagrant/README.md
 create mode 100644 secrets/pki/vagrant/Vagrantfile
 create mode 100755 secrets/pki/vagrant/demo/clean_demo.sh
 create mode 100644 secrets/pki/vagrant/demo/default_env.sh
 create mode 100644 secrets/pki/vagrant/demo/demo-magic.sh
 create mode 100755 secrets/pki/vagrant/demo/demo1_bootstrap_environment.sh
 create mode 100755 secrets/pki/vagrant/demo/demo2_short_ttls.sh
 create mode 100755 secrets/pki/vagrant/demo/demo3_renew_lease.sh
 create mode 100755 secrets/pki/vagrant/demo/demo4_revoke_cert.sh
 create mode 100755 secrets/pki/vagrant/demo/demo5_consul_template_renew.sh
 create mode 100644 secrets/pki/vagrant/demo/tokens/short-ttl-hashidemos-com
 create mode 100644 secrets/pki/vagrant/demo/vault_demo_functions.sh
 create mode 100755 secrets/pki/vagrant/run_me_first.sh

diff --git a/secrets/pki/vagrant/.gitignore b/secrets/pki/vagrant/.gitignore
new file mode 100644
index 00000000..486a479b
--- /dev/null
+++ b/secrets/pki/vagrant/.gitignore
@@ -0,0 +1,5 @@
+provision.sh
+user-data
+.vagrant*
+demo/initial_root_token
+demo/vault_init_output.txt
diff --git a/secrets/pki/vagrant/CONTRIBUTING.md b/secrets/pki/vagrant/CONTRIBUTING.md
new file mode 100644
index 00000000..6662073a
--- /dev/null
+++ b/secrets/pki/vagrant/CONTRIBUTING.md
@@ -0,0 +1,71 @@
+# How to Contribute
+
+CoreOS projects are [Apache 2.0 licensed](LICENSE) and accept contributions via
+GitHub pull requests.  This document outlines some of the conventions on
+development workflow, commit message formatting, contact points and other
+resources to make it easier to get your contribution accepted.
+
+# Certificate of Origin
+
+By contributing to this project you agree to the Developer Certificate of
+Origin (DCO). This document was created by the Linux Kernel community and is a
+simple statement that you, as a contributor, have the legal right to make the
+contribution. See the [DCO](DCO) file for details.
+
+# Email and Chat
+
+The project currently uses the general CoreOS email list and IRC channel:
+- Email: [coreos-dev](https://groups.google.com/forum/#!forum/coreos-dev)
+- IRC: #[coreos](irc://irc.freenode.org:6667/#coreos) IRC channel on freenode.org
+
+Please avoid emailing maintainers found in the MAINTAINERS file directly. They
+are very busy and read the mailing lists.
+
+## Getting Started
+
+- Fork the repository on GitHub
+- Read the [README](README.md) for build and test instructions
+- Play with the project, submit bugs, submit patches!
+
+## Contribution Flow
+
+This is a rough outline of what a contributor's workflow looks like:
+
+- Create a topic branch from where you want to base your work (usually master).
+- Make commits of logical units.
+- Make sure your commit messages are in the proper format (see below).
+- Push your changes to a topic branch in your fork of the repository.
+- Make sure the tests pass, and add any new tests as appropriate.
+- Submit a pull request to the original repository.
+
+Thanks for your contributions!
+
+### Format of the Commit Message
+
+We follow a rough convention for commit messages that is designed to answer two
+questions: what changed and why. The subject line should feature the what and
+the body of the commit should describe the why.
+
+```
+scripts: add the test-cluster command
+
+this uses tmux to setup a test cluster that you can easily kill and
+start for debugging.
+
+Fixes #38
+```
+
+The format can be described more formally as follows:
+
+```
+<subsystem>: <what changed>
+<BLANK LINE>
+<why this change was made>
+<BLANK LINE>
+<footer>
+```
+
+The first line is the subject and should be no longer than 70 characters, the
+second line is always blank, and other lines should be wrapped at 80 characters.
+This allows the message to be easier to read on GitHub as well as in various
+git tools.
diff --git a/secrets/pki/vagrant/DCO b/secrets/pki/vagrant/DCO
new file mode 100644
index 00000000..716561d5
--- /dev/null
+++ b/secrets/pki/vagrant/DCO
@@ -0,0 +1,36 @@
+Developer Certificate of Origin
+Version 1.1
+
+Copyright (C) 2004, 2006 The Linux Foundation and its contributors.
+660 York Street, Suite 102,
+San Francisco, CA 94110 USA
+
+Everyone is permitted to copy and distribute verbatim copies of this
+license document, but changing it is not allowed.
+
+
+Developer's Certificate of Origin 1.1
+
+By making a contribution to this project, I certify that:
+
+(a) The contribution was created in whole or in part by me and I
+    have the right to submit it under the open source license
+    indicated in the file; or
+
+(b) The contribution is based upon previous work that, to the best
+    of my knowledge, is covered under an appropriate open source
+    license and I have the right under that license to submit that
+    work with modifications, whether created in whole or in part
+    by me, under the same open source license (unless I am
+    permitted to submit under a different license), as indicated
+    in the file; or
+
+(c) The contribution was provided directly to me by some other
+    person who certified (a), (b) or (c) and I have not modified
+    it.
+
+(d) I understand and agree that this project and the contribution
+    are public and that a record of the contribution (including all
+    personal information I submit with it, including my sign-off) is
+    maintained indefinitely and may be redistributed consistent with
+    this project or the open source license(s) involved.
diff --git a/secrets/pki/vagrant/LICENSE b/secrets/pki/vagrant/LICENSE
new file mode 100644
index 00000000..e06d2081
--- /dev/null
+++ b/secrets/pki/vagrant/LICENSE
@@ -0,0 +1,202 @@
+Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "{}"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright {yyyy} {name of copyright owner}
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+
diff --git a/secrets/pki/vagrant/MAINTAINERS b/secrets/pki/vagrant/MAINTAINERS
new file mode 100644
index 00000000..def05fd4
--- /dev/null
+++ b/secrets/pki/vagrant/MAINTAINERS
@@ -0,0 +1,3 @@
+Jon Boulle <jonathan.boulle@coreos.com> (@jonboulle)
+Brian Waldon <brian.waldon@coreos.com> (@bcwaldon)
+Jake Lundberg <grove-mountain-devops@nym.hush.com> (@grove-mountain)
diff --git a/secrets/pki/vagrant/NOTICE b/secrets/pki/vagrant/NOTICE
new file mode 100644
index 00000000..b39ddfa5
--- /dev/null
+++ b/secrets/pki/vagrant/NOTICE
@@ -0,0 +1,5 @@
+CoreOS Project
+Copyright 2014 CoreOS, Inc
+
+This product includes software developed at CoreOS, Inc.
+(http://www.coreos.com/).
diff --git a/secrets/pki/vagrant/README.md b/secrets/pki/vagrant/README.md
new file mode 100644
index 00000000..9277a206
--- /dev/null
+++ b/secrets/pki/vagrant/README.md
@@ -0,0 +1,186 @@
+# Vault PKI Secrets Engine
+
+Use Vault to create X509 certificates for usage in mTLS or other arbitrary PKI encryption.   While this can be used to create web server certificates.  If users do not import the CA chains, the browser will complain about self-signed certificates.
+
+Creating PKI certificates is generally a cumbersome process using traditional tools like openssl or even more advanced frameworks like CFSSL.   These tools also require a human component to verify certificate distribution meets organizational security policies.   
+
+## Reference Material
+
+
+* [RFC 5280 Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile](https://tools.ietf.org/html/rfc5280)
+* [OpenSSL x509 Man Pages](https://www.openssl.org/docs/man1.1.0/apps/x509.html)
+
+## Estimated Time to Complete
+15 minutes
+
+## Personas
+
+### Operator
+
+The operator will be responsible for creating the vault/consul clusters.  In the absence of dedicated security teams, they may also be responsible for creating all auth methods, ACLs, roles and secret engine mount points
+
+### Developer
+
+The developer will use the PKI Intermediate issue endpoints to issue leaf certs.   They will most likely use API endpoints to issue certs directly into applications.
+
+### InfoSec
+
+Infosec will create ACLs, roles and tie together auth methods to policies.   They may also be responsible for enabling the various PKI engines for root and intermediate CAs.   
+
+
+## Challenge
+Using a vagrant image: 
+  * Start a minimal Vault/Consul cluster
+  * Bootstrap the cluster to be secured with PKI certificates for internode communication
+  * Create a short-lived TTL PKI Cert.  See it expire
+  * Renew the certificate using scripts
+  * Revoke the certificate, verify CRL entries
+  * Use consul-template to create certs & renew them automatically
+
+
+## Solution
+Run a set of provisioning scripts against your Vault cluster.  This will create:
+* A PKI CA
+* A PKI Intermediate CA
+* Roles and Policies to access the Intermediate CA
+* Lower privileged token to use for authentication
+* Leaf cert(s) from the Intermediate CA
+
+## Prerequisites
+* Linux or Mac system to install/run this guide (Windows support in the future)
+* [VirtualBox](https://www.virtualbox.org/wiki/Downloads) installed (tested with 5.2.6)
+* [Vagrant](https://www.vagrantup.com/downloads.html) installed (tested with 2.0.2)
+* Three open terminal windows
+
+
+## Steps
+
+### Step 1: Clone this repo 
+```
+git clone git@github.com:hashicorp/vault-guides.git
+```
+
+### Step 2: Change to pki directory
+```
+cd vault-guides/secrets/pki/vagrant
+```
+
+### Step 3 (optional): Modify environment variables
+There are a number of default environment variables listed in demo/default_env.sh. For the most part, these variables should suffice for this guide, but you can override them to customize the guide.   The DEFAULT_* variables have default settings, just remove DEFAULT_ to actual envvar.
+
+Likely envs to override:
+
+```
+ROOT_DOMAIN=hashidemos.com
+VAULT_VERSION=0.10.1
+CONSUL_VERSION=1.0.6
+CONSUL_TEMPLATE_VERSION=0.19.4
+```
+
+### Step 4: Update user-data and provisioning scripts
+The user-data and provisioning scripts rely on the environment variables you've set (or left default) from the previous step.   Run this to create the customized provisioners
+```
+./run_me_first.sh
+```
+
+### Step 5: Start vagrant image
+```
+vagrant up
+```
+**NOTE**
+
+Vagrant will need to make some updates to /etc/exports.  This will require sudo access, so when prompted for your password, this is what it's for.  The same will be required during destroy to remove the entries
+
+If you're using this guide over time, you may see messages like the following:
+```
+==> core-01: A newer version of the box 'coreos-stable' for provider 'virtualbox' is
+==> core-01: available! You currently have version '1745.4.0'. The latest is version
+==> core-01: '1745.5.0'. Run `vagrant box update` to update.
+```
+It's best to run the update so CoreOS functions properly. 
+
+```
+vagrant box update
+vagrant destroy
+vagrant up
+```
+
+
+### Step 6: Connect to vagrant with three terminal windows
+If you have a terminal like iTerm2 or using Screen/Tmux or any other kind of terminal window management, open up three sessions to vagrant.   I like to tile one big window on one side with the other side split horizontally with two smaller windows
+
+__Diagram created with [Asciiflow](http://asciiflow.com/)__
+```
++--+--+
+|  |  |
+|  +--+
+|  |  |
++--+--+
+
+```
+
+```
+vagrant ssh
+```
+
+### Step 7: Run demo1_bootstrap_environment.sh
+**NOTE**
+This guide uses a helper script called demo-magic.sh to prevent users needing to type/copypasta commands.   For most of the demos, you will need to press "Enter/Return" after the command is displayed.    There are some demos which change the behavior to auto-run.   A message will be output when those changes occur.
+
+You can change this behavior by updating PROMPT_TIMEOUT environment variable to a non-zero number.  0 means wait for button press, any number is the number of seconds to wait until proceeding.
+
+```
+sudo /demo/demo1_bootstrap_environment.sh
+```
+
+This will bootstrap a Vault Dev server to create an initial set of certificates that will later be used for securing Vault and Consul communicates with TLS.   This instance will be stopped and a new non-dev server will be started to run the rest of the demo.
+
+### Step 8: Run demo2_short_ttls.sh
+This demonstration creates a short lived TTL (Default 60s) and immediately begins verify the cert with openssl.   You should notice that after the TTL expires, the cert becomes invalid.   Keep this running in this window.
+```
+sudo /demo/demo2_short_ttls.sh
+```
+
+### Step 9: Run demo3_renew_lease.sh in another window
+This demostration renews the certificate that's not invalid on a regular basis. You should now see the certificate is valid in the window running demo2.  Leave this running in this window
+
+```
+sudo /demo/demo3_renew_lease.sh 
+```
+
+### Step 10: Run demo4_revoke_cert.sh in another window
+This demonstration creates a CRL entry in the CRL endpoint registered within Vault.   You will notice that the CRL has the serial number of the certificate you revoked into.  However, if you're looking at the demo2 window, you should notice that the certificate is still valid.  ???  
+
+This is a reminder that when you're validating certificates, make sure to check the CRL to ensure it hasn't been revoked!
+
+There's another point to this however.   Using short-lived TTLs is a powerful pattern that often obviates the need to use CRLs because the certificate will expire in such a short period of time to reduce any kind of damage caused by a leaked certificate.   
+
+```
+sudo /demo/demo4_revoke_cert.sh
+```
+
+If you wait until the renewal runs in demo3 window, you can run this command again.  Notice the change in serial number for the revoked certificate.
+
+### Step 11: Run demo5_consul_template_renew.sh
+
+Before running this, stop the demo2 and demo3 windows (Ctrl-C).   I usually do this in the big window.
+
+This demonstration combines the concepts of demo2 and demo3 together using consul-template as the structure for renewal.  Consul-template has the ability to watch certain Vault endpoints and dump the secrets to a file location of your choosing.   It's smart enough to know to renew any tokens that it's using that are expiring.   
+
+```
+sudo /demo/demo5_consul_template_renew.sh
+```
+
+After running this for 2-3 minutes (or however long you want), stop the demo using Ctrl-c.
+
+**NOTE**
+
+Vault doesn't have the concept of blocking queries like Consul does.   This means that it doesn't have the capabilities of noticing changes to a particular secret you are monitoring.  However, in the case of PKI certs, consul-template will renew based on the lease for the certificate.   Keep this in mind of you're trying to use consul-template for automating retrieval of other Vault secrets. 
+
+### Step 12: Tear down the guide
+Congratulations!  You've taken a step into the wonderful world of PKI Provisioning with Vault!   To be complete, clean up your guide environment.   Also, remember that vagrant will ask for your sudo password to remove NFS entries from /etc/exports:
+
+```
+exit
+vagrant destroy
+```
diff --git a/secrets/pki/vagrant/Vagrantfile b/secrets/pki/vagrant/Vagrantfile
new file mode 100644
index 00000000..b3a3e313
--- /dev/null
+++ b/secrets/pki/vagrant/Vagrantfile
@@ -0,0 +1,145 @@
+# -*- mode: ruby -*-
+# # vi: set ft=ruby :
+
+require 'fileutils'
+
+Vagrant.require_version ">= 1.6.0"
+
+CLOUD_CONFIG_PATH = File.join(File.dirname(__FILE__), "user-data")
+PROVISION_SCRIPT = File.join(File.dirname(__FILE__), "provision.sh")
+CONFIG = File.join(File.dirname(__FILE__), "config.rb")
+
+# Defaults for config options defined in CONFIG
+$num_instances = 1
+$instance_name_prefix = "core"
+$update_channel = "stable"
+$image_version = "current"
+$enable_serial_logging = false
+$share_home = false
+$vm_gui = false
+$vm_memory = 1024
+$vm_cpus = 1
+$shared_folders = { "./demo" => "/demo"}
+$forwarded_ports = {}
+
+# Attempt to apply the deprecated environment variable NUM_INSTANCES to
+# $num_instances while allowing config.rb to override it
+if ENV["NUM_INSTANCES"].to_i > 0 && ENV["NUM_INSTANCES"]
+  $num_instances = ENV["NUM_INSTANCES"].to_i
+end
+
+if File.exist?(CONFIG)
+  require CONFIG
+end
+
+# Use old vb_xxx config variables when set
+def vm_gui
+  $vb_gui.nil? ? $vm_gui : $vb_gui
+end
+
+def vm_memory
+  $vb_memory.nil? ? $vm_memory : $vb_memory
+end
+
+def vm_cpus
+  $vb_cpus.nil? ? $vm_cpus : $vb_cpus
+end
+
+Vagrant.configure("2") do |config|
+  # always use Vagrants insecure key
+  config.ssh.insert_key = false
+
+  config.vm.box = "coreos-%s" % $update_channel
+  if $image_version != "current"
+      config.vm.box_version = $image_version
+  end
+  config.vm.box_url = "http://%s.release.core-os.net/amd64-usr/%s/coreos_production_vagrant.json" % [$update_channel, $image_version]
+
+  ["vmware_fusion", "vmware_workstation"].each do |vmware|
+    config.vm.provider vmware do |v, override|
+      override.vm.box_url = "http://%s.release.core-os.net/amd64-usr/%s/coreos_production_vagrant_vmware_fusion.json" % [$update_channel, $image_version]
+    end
+  end
+
+  config.vm.provider :virtualbox do |v|
+    # On VirtualBox, we don't have guest additions or a functional vboxsf
+    # in CoreOS, so tell Vagrant that so it can be smarter.
+    v.check_guest_additions = false
+    v.functional_vboxsf     = false
+  end
+
+  # plugin conflict
+  if Vagrant.has_plugin?("vagrant-vbguest") then
+    config.vbguest.auto_update = false
+  end
+
+  (1..$num_instances).each do |i|
+    config.vm.define vm_name = "%s-%02d" % [$instance_name_prefix, i] do |config|
+      config.vm.hostname = vm_name
+
+      if $enable_serial_logging
+        logdir = File.join(File.dirname(__FILE__), "log")
+        FileUtils.mkdir_p(logdir)
+
+        serialFile = File.join(logdir, "%s-serial.txt" % vm_name)
+        FileUtils.touch(serialFile)
+
+        ["vmware_fusion", "vmware_workstation"].each do |vmware|
+          config.vm.provider vmware do |v, override|
+            v.vmx["serial0.present"] = "TRUE"
+            v.vmx["serial0.fileType"] = "file"
+            v.vmx["serial0.fileName"] = serialFile
+            v.vmx["serial0.tryNoRxLoss"] = "FALSE"
+          end
+        end
+
+        config.vm.provider :virtualbox do |vb, override|
+          vb.customize ["modifyvm", :id, "--uart1", "0x3F8", "4"]
+          vb.customize ["modifyvm", :id, "--uartmode1", serialFile]
+        end
+      end
+
+      if $expose_docker_tcp
+        config.vm.network "forwarded_port", guest: 2375, host: ($expose_docker_tcp + i - 1), auto_correct: true
+      end
+
+      $forwarded_ports.each do |guest, host|
+        config.vm.network "forwarded_port", guest: guest, host: host, auto_correct: true
+      end
+
+      ["vmware_fusion", "vmware_workstation"].each do |vmware|
+        config.vm.provider vmware do |v|
+          v.gui = vm_gui
+          v.vmx['memsize'] = vm_memory
+          v.vmx['numvcpus'] = vm_cpus
+        end
+      end
+
+      config.vm.provider :virtualbox do |vb|
+        vb.gui = vm_gui
+        vb.memory = vm_memory
+        vb.cpus = vm_cpus
+      end
+
+      ip = "172.17.8.#{i+100}"
+      config.vm.network :private_network, ip: ip
+
+      # Uncomment below to enable NFS for sharing the host machine into the coreos-vagrant VM.
+      #config.vm.synced_folder ".", "/home/core/share", id: "core", :nfs => true, :mount_options => ['nolock,vers=3,udp']
+      $shared_folders.each_with_index do |(host_folder, guest_folder), index|
+        config.vm.synced_folder host_folder.to_s, guest_folder.to_s, id: "core-share%02d" % index, nfs: true, mount_options: ['nolock,vers=3,udp']
+      end
+
+      if $share_home
+        config.vm.synced_folder ENV['HOME'], ENV['HOME'], id: "home", :nfs => true, :mount_options => ['nolock,vers=3,udp']
+      end
+
+      if File.exist?(CLOUD_CONFIG_PATH)
+        config.vm.provision :file, :source => "#{CLOUD_CONFIG_PATH}", :destination => "/tmp/vagrantfile-user-data"
+        config.vm.provision :shell, :inline => "mv /tmp/vagrantfile-user-data /var/lib/coreos-vagrant/", :privileged => true
+	config.vm.provision :shell, :path => "provision.sh", :privileged => true 
+      end
+
+    end
+  end
+end
diff --git a/secrets/pki/vagrant/demo/clean_demo.sh b/secrets/pki/vagrant/demo/clean_demo.sh
new file mode 100755
index 00000000..3488b6e9
--- /dev/null
+++ b/secrets/pki/vagrant/demo/clean_demo.sh
@@ -0,0 +1,13 @@
+. demo-magic.sh
+
+echo $(green "Removing certificates")
+rm -f /etc/certs/*
+echo
+echo $(green "Removing temporary config files")
+rm -f /var/tmp/*.{json,pem}
+echo
+echo $(green "Stopping Vault")
+systemctl stop docker-vault
+echo
+echo $(green "Removing Vault entries from Consul")
+docker exec -it consul consul kv delete -recurse vault/ &> /dev/null
diff --git a/secrets/pki/vagrant/demo/default_env.sh b/secrets/pki/vagrant/demo/default_env.sh
new file mode 100644
index 00000000..e87348f7
--- /dev/null
+++ b/secrets/pki/vagrant/demo/default_env.sh
@@ -0,0 +1,61 @@
+# These are all the defaults for any environment variables below.  Setting environment variables before accessing this set of defaults will override anything set here.
+
+# Software versions.   These are probably the only values that should change over time
+DEFAULT_VAULT_VERSION=0.10.1
+DEFAULT_CONSUL_VERSION=1.0.6
+DEFAULT_CONSUL_TEMPLATE_VERSION=0.19.4
+
+DEFAULT_ROOT_DOMAIN=hashidemos.com
+
+DEFAULT_ROOT_PKI_PATH=pki_root
+DEFAULT_VAULT_PORT=8200
+DEFAULT_ROOT_CERT_TTL=87648h
+DEFAULT_INTERMEDIATE_CA_PATH=pki_int_main
+DEFAULT_INTERMEDIATE_CERT_TTL=43824h
+# Make sure token TTLs are longer than cert TTLs so you don't have the expiring token kill the lease on the cert before you expect it to.
+DEFAULT_TOKEN_TTL=120s
+DEFAULT_LOCAL_MOUNT=/var/tmp
+DEFAULT_DOCKER_MOUNT=/var/tmp/docker
+
+
+ROOT_PKI_PATH=${ROOT_PKI_PATH:-$DEFAULT_ROOT_PKI_PATH}
+ROOT_DOMAIN=${ROOT_DOMAIN:-$DEFAULT_ROOT_DOMAIN}
+DEMO_DOMAIN=dev.${ROOT_DOMAIN}
+
+VAULT_DOCKER=vault
+VAULT_VERSION=${VAULT_VERSION:-$DEFAULT_VAULT_VERSION}
+VAULT_IMAGE=${VAULT_DOCKER}:${VAULT_VERSION}
+VAULT_HOST=vault1.${DEMO_DOMAIN}
+VAULT_PORT=${VAULT_PORT:-$DEFAULT_VAULT_PORT}
+
+CONSUL_DOCKER=consul
+CONSUL_VERSION=${CONSUL_VERSION:-$DEFAULT_CONSUL_VERSION}
+CONSUL_IMAGE=${CONSUL_DOCKER}:${CONSUL_VERSION}
+CONSUL_HOST=consul1.${DEMO_DOMAIN}
+
+CONSUL_TEMPLATE_VERSION=${CONSUL_TEMPLATE_VERSION:-$DEFAULT_CONSUL_TEMPLATE_VERSION}
+# Fixing the arch because this is probably always going to run on a fixed platform in a Vagrant
+CONSUL_TEMPLATE_BIN="consul-template_${CONSUL_TEMPLATE_VERSION}_linux_amd64.tgz"
+CONSUL_TEMPLATE_URL="https://releases.hashicorp.com/consul-template/${CONSUL_TEMPLATE_VERSION}/${CONSUL_TEMPLATE_BIN}"
+
+# Root CA Certs can most likely be long-lived certs.  Set for 10 years
+ROOT_CERT_TTL=${ROOT_CERT_TTL:-$DEFAULT_ROOT_CERT_TTL}
+ROOT_ROLE=${ROOT_DOMAIN/./-}
+
+# Default PKI Intermediate Path
+INTERMEDIATE_CA_PATH=${INTERMEDIATE_CA_PATH:-$DEFAULT_INTERMEDIATE_CA_PATH}
+# Intermediate certs can also be longer lived. Set for 5 years.
+INTERMEDIATE_CERT_TTL=${INTERMEDIATE_CERT_TTL:-$DEFAULT_INTERMEDIATE_CERT_TTL}  
+
+
+LOCAL_MOUNT=${LOCAL_MOUNT:-$DEFAULT_LOCAL_MOUNT}
+DOCKER_MOUNT=${DOCKER_MOUNT:-$DEFAULT_DOCKER_MOUNT}
+
+# Local file used to store parameters. Typically used for curl commands payload
+# DO NOT STORE LONG TERM DATA HERE!
+# This file will get overwritten by any process needing to store input parameters.
+INPUT_PARAMS=input-params.json
+# Local fs version
+LOCAL_INPUT_PARAMS=${LOCAL_MOUNT}/${INPUT_PARAMS}
+# Docker fs version (if needed to be read in by the local process)
+DOCKER_INPUT_PARAMS=${DOCKER_MOUNT}/${INPUT_PARAMS}
diff --git a/secrets/pki/vagrant/demo/demo-magic.sh b/secrets/pki/vagrant/demo/demo-magic.sh
new file mode 100644
index 00000000..ed46ed02
--- /dev/null
+++ b/secrets/pki/vagrant/demo/demo-magic.sh
@@ -0,0 +1,200 @@
+#!/usr/bin/env bash
+
+###############################################################################
+#
+# demo-magic.sh
+#
+# Copyright (c) 2015 Paxton Hare
+#
+# This script lets you script demos in bash. It runs through your demo script when you press
+# ENTER. It simulates typing and runs commands.
+#
+###############################################################################
+
+# Preferred demo prompt
+DEMO_PROMPT='[\u@\[\e[32;40m\]\h\[\e[0m\]] '
+
+# the speed to "type" the text
+TYPE_SPEED=${TYPE_SPEED:-20}
+
+# no wait after "p" or "pe"
+NO_WAIT=false
+
+# if > 0, will pause for this amount of seconds before automatically proceeding with any p or pe
+PROMPT_TIMEOUT=0
+
+# Wait before a command is run
+PRE_WAIT=true
+# Wait after a command is run
+POST_WAIT=true
+
+# handy color vars for pretty prompts
+BLACK="\033[0;30m"
+BLUE="\033[0;34m"
+GREEN="\033[0;32m"
+CYAN="\033[0;36m"
+RED="\033[0;31m"
+PURPLE="\033[0;35m"
+YELLOW="\033[0;33m"
+WHITE="\033[1;37m"
+COLOR_RESET="\033[0m"
+
+green () {
+  echo -e "${GREEN}$@${COLOR_RESET}"
+}
+
+red () {
+  echo -e "${RED}$@${COLOR_RESET}"
+}
+
+yellow () {
+  echo -e "${YELLOW}$@${COLOR_RESET}"
+}
+
+##
+# prints the script usage
+##
+function usage() {
+  echo -e ""
+  echo -e "Usage: $0 [options]"
+  echo -e ""
+  echo -e "\tWhere options is one or more of:"
+  echo -e "\t-h\tPrints Help text"
+  echo -e "\t-d\tDebug mode. Disables simulated typing"
+  echo -e "\t-n\tNo wait"
+  echo -e "\t-w\tWaits max the given amount of seconds before proceeding with demo (e.g. `-w5`)"
+  echo -e ""
+}
+
+##
+# wait for user to press ENTER
+# if $PROMPT_TIMEOUT > 0 this will be used as the max time for proceeding automatically
+##
+function wait() {
+  if [[ "$PROMPT_TIMEOUT" == "0" ]]; then
+    read -rs
+  else
+    read -rst "$PROMPT_TIMEOUT"
+  fi
+}
+
+##
+# print command only. Useful for when you want to pretend to run a command
+#
+# takes 1 param - the string command to print
+#
+# usage: p "ls -l"
+#
+##
+function p() {
+  cmd=$1
+
+  echo ""
+  # render the prompt
+  x=$(PS1="$DEMO_PROMPT" "$BASH" --norc -i </dev/null 2>&1 | sed -n '${s/^\(.*\)exit$/\1/p;}')
+  printf "$x"
+
+  # wait for the user to press a key before typing the command
+  if [[ -n $PRE_WAIT ]]; then
+    wait
+  fi
+
+  if [[ -z $TYPE_SPEED ]]; then
+    echo -en "\033[0m$cmd"
+  else
+    echo -en "\033[0m$cmd" | pv -qL $[$TYPE_SPEED+(-2 + RANDOM%5)];
+  fi
+
+  # wait for the user to press a key before moving on
+  if $POST_WAIT; then
+    wait
+  fi
+  echo ""
+  echo ""
+}
+
+##
+# Prints and executes a command
+#
+# takes 1 parameter - the string command to run
+#
+# usage: pe "ls -l"
+#
+##
+function pe() {
+  # print the command
+  p "$@"
+
+  # execute the command
+  eval "$@"
+  echo ""
+}
+
+##
+# Enters script into interactive mode
+#
+# and allows newly typed commands to be executed within the script
+#
+# usage : cmd
+#
+##
+function cmd() {
+  # render the prompt
+  x=$(PS1="$DEMO_PROMPT" "$BASH" --norc -i </dev/null 2>&1 | sed -n '${s/^\(.*\)exit$/\1/p;}')
+  printf "$x\033[0m"
+  read command
+  eval "${command}"
+}
+
+
+function check_pv() {
+  command -v pv >/dev/null 2>&1 || {
+
+    echo ""
+    echo -e "${RED}##############################################################"
+    echo "# HOLD IT!! I require pv but it's not installed.  Aborting." >&2;
+    echo -e "${RED}##############################################################"
+    echo ""
+    echo -e "${COLOR_RESET}Installing pv:"
+    echo ""
+    echo -e "${BLUE}Mac:${COLOR_RESET} $ brew install pv"
+    echo ""
+    echo -e "${BLUE}Other:${COLOR_RESET} http://www.ivarch.com/programs/pv.shtml"
+    echo -e "${COLOR_RESET}"
+    # Only exit is TYPE_SPEED is defined, this will work fine without it.   
+    if [[ -n ${TYPE_SPEED} ]];then
+      exit 1;
+    fi
+  }
+}
+
+#check_pv
+#
+# handle some default params
+# -h for help
+# -d for disabling simulated typing
+#
+while getopts ":dhnptw:" opt; do
+  case $opt in
+    h)
+      usage
+      exit 1
+      ;;
+    d)
+      unset TYPE_SPEED
+      ;;
+    n)
+      NO_WAIT=true
+      unset PRE_WAIT
+      unset POST_WAIT
+      ;;
+    p)
+      unset PRE_WAIT
+      ;;
+    t)
+      unset POST_WAIT
+      ;;
+    w)
+      PROMPT_TIMEOUT=$OPTARG
+  esac
+done
diff --git a/secrets/pki/vagrant/demo/demo1_bootstrap_environment.sh b/secrets/pki/vagrant/demo/demo1_bootstrap_environment.sh
new file mode 100755
index 00000000..418eb0d1
--- /dev/null
+++ b/secrets/pki/vagrant/demo/demo1_bootstrap_environment.sh
@@ -0,0 +1,103 @@
+# Read in the default environment variables
+. /demo/default_env.sh
+
+# Read in all shared functions
+. /demo/vault_demo_functions.sh
+
+# We don't want to use TLS at this point so make this nothing
+VAULT_USE_TLS=
+# Pull early so time it takes to pull down doesn't affect runs from service start
+/usr/bin/docker pull ${VAULT_IMAGE}
+
+# Since we're running with two different names, deconflict the variable
+# Run a dev version of the vault server to bootstrap the certs
+echo $(green Starting Vault Dev Server)
+systemctl start docker-vault-dev
+sleep 10
+
+VAULT_DOCKER_PREV=${VAULT_DOCKER}
+VAULT_DOCKER=dev-vault
+# Derive values from Docker Vault server
+# During bootstraping, node names aren't necessary so we'll use the IP as well as the 
+# Root token shown in the logs during start of dev server
+VAULT_IP=$(docker inspect ${VAULT_DOCKER} | jq .[0].NetworkSettings.Networks.bridge.IPAddress | tr -d '"')
+VAULT_ADDR=http://${VAULT_IP}:${VAULT_PORT}
+VAULT_TOKEN=$(docker logs ${VAULT_DOCKER} 2>&1 | grep -E "Root Token:" | awk '{print $3}')
+
+# Since consul will actually be writing locally, add its user to the local system so we don't have permissions issues.
+groupadd -g 1000 consul
+useradd -u 100 -g 1000 consul
+
+mkdir -p /etc/certs
+mkdir -p /var/consul/data && chown -R consul:consul /var/consul/data
+mkdir -p /etc/consul && chown -R consul:consul /etc/consul
+# Vault will only be reading mounted data, so no need for mapping user
+# Annoyingly, both consul and vault users have the same UID/GID in the container
+# This could easily be fixed by just cutting a new docker with new UID/GID mappings
+mkdir -p /etc/vault
+
+bootstrap_ca
+
+echo $(yellow "Roles are the entities allowed to create certificates")
+echo
+# Create the roles that will create the certs
+# Change role names . to -
+
+create_role ${ROOT_DOMAIN/./-} pki_int_main ${ROOT_DOMAIN} ${INTERMEDIATE_CERT_TTL}
+create_role consul-${DEMO_DOMAIN/./-} pki_int_main ${DEMO_DOMAIN} ${INTERMEDIATE_CERT_TTL}
+create_role vault-${DEMO_DOMAIN/./-} pki_int_main ${DEMO_DOMAIN} ${INTERMEDIATE_CERT_TTL}
+
+# Issue certs
+issue_cert ${ROOT_DOMAIN} 168h pki_int_main ${ROOT_DOMAIN/./-}
+issue_cert ${CONSUL_HOST} 168h pki_int_main consul-${DEMO_DOMAIN/./-}
+issue_cert ${VAULT_HOST} 168h pki_int_main vault-${DEMO_DOMAIN/./-}
+
+# Copy the local mount files over to the certs directory.  This also gets mounted
+# Into the Consul and Vault docker containers for usage
+cp ${LOCAL_MOUNT}/*.pem /etc/certs
+cat /etc/certs/${VAULT_HOST}_ca_chain.pem /etc/certs/CA_cert.pem > /etc/certs/${VAULT_HOST}_ca_chain_full.pem
+
+# stop the dev server if we're done with it
+echo $(green Stopping Vault Dev Server)
+systemctl stop docker-vault-dev
+
+# Go back to using the default name
+VAULT_DOCKER=${VAULT_DOCKER_PREV}
+# Now that the certs are in place, restart the services that probably failed on boot
+echo $(green Starting main production Vault and Consul)
+systemctl start docker-consul docker-vault
+sleep 10
+
+VAULT_USE_TLS=true
+VAULT_ADDR=https://${VAULT_HOST}:${VAULT_PORT}
+OUTPUT_FILE=/demo/vault_init_output.txt
+INITIAL_ROOT_TOKEN=/demo/initial_root_token
+
+# Initialize vault and capture output.
+echo $(green Initializing Vault)
+vault operator init | grep : > ${OUTPUT_FILE}
+
+# Yeah, I made fun of this in the slides, but that's different!
+chmod 0600 ${OUTPUT_FILE}
+
+# Unseal the vault with the unseal keys
+for i in $(cat ${OUTPUT_FILE} | grep Unseal | cut -f 2 -d : | tr -d ' ');do
+  vault operator unseal $i
+done
+
+# Capture the root token from the output
+echo "VAULT_TOKEN=$(cat ${OUTPUT_FILE} | grep "Initial Root Token" | cut -f 2 -d : | tr -d ' ')" > ${INITIAL_ROOT_TOKEN}
+echo $(green Saved Initial Root Token to ${INITIAL_ROOT_TOKEN})
+. ${INITIAL_ROOT_TOKEN}
+
+# Why bootstrap twice?  Well, because the dev server is dead and didn't persist anything
+# We don't want to wait on this, just let it run automatically with a small pause
+echo
+PROMPT_TIMEOUT=1
+echo $(yellow "Changing demo mode to remove wait for return/enter and proceed after ${PROMPT_TIMEOUT}s")
+echo
+PROMPT_TIMEOUT=10
+wait
+PROMPT_TIMEOUT=1
+echo $(green Bootstrapping CA)
+bootstrap_ca
diff --git a/secrets/pki/vagrant/demo/demo2_short_ttls.sh b/secrets/pki/vagrant/demo/demo2_short_ttls.sh
new file mode 100755
index 00000000..5241a842
--- /dev/null
+++ b/secrets/pki/vagrant/demo/demo2_short_ttls.sh
@@ -0,0 +1,38 @@
+# Source in default environment variables
+. /demo/default_env.sh
+
+# Source in all functions
+. /demo/vault_demo_functions.sh 
+
+VAULT_USE_TLS=true
+VAULT_ADDR=https://${VAULT_HOST}:${VAULT_PORT}
+
+. /demo/initial_root_token
+ROLE=short-ttl-${ROOT_ROLE}
+
+PKI_PATH=${INTERMEDIATE_CA_PATH}
+
+# Only try to create the role if it doesn't exist
+vault read ${INTERMEDIATE_CA_PATH}/roles/${ROLE} &> /dev/null
+if [ $? -gt 0 ];then
+  create_role ${ROLE} ${PKI_PATH} ${DEMO_DOMAIN} ${INTERMEDIATE_CERT_TTL}
+fi
+
+create_issue_policy ${ROLE} ${PKI_PATH} ${ROOT_PKI_PATH}
+echo $(green "Current vault token: ${VAULT_TOKEN}")
+echo $(yellow "Shifting to lower privileged token")
+# This sets the $TOKEN variable internally
+create_token ${ROLE} ${DEFAULT_TOKEN_TTL}
+VAULT_TOKEN=$(cat ${LOCAL_MOUNT}/token-${ROLE})
+echo $(green "Current vault token: ${VAULT_TOKEN}")
+
+COMMON_NAME=shortttl.${DEMO_DOMAIN}
+issue_cert ${COMMON_NAME} 60 ${INTERMEDIATE_CA_PATH} ${ROLE}
+echo
+
+echo $(yellow "Testing certificate validity using openssl")
+while true;do
+  echo -n "$(date +%H:%M:%S): Verifying Certificate: " 
+  verify ${COMMON_NAME}
+  sleep 5
+done
diff --git a/secrets/pki/vagrant/demo/demo3_renew_lease.sh b/secrets/pki/vagrant/demo/demo3_renew_lease.sh
new file mode 100755
index 00000000..6664c28b
--- /dev/null
+++ b/secrets/pki/vagrant/demo/demo3_renew_lease.sh
@@ -0,0 +1,24 @@
+# Wait seconds before automatically running the next command
+DEMO_WAIT=1
+
+# Source in default environment variables
+. /demo/default_env.sh
+
+# Source in all functions
+. /demo/vault_demo_functions.sh 
+
+VAULT_USE_TLS=true
+VAULT_ADDR=https://${VAULT_HOST}:${VAULT_PORT}
+
+. /demo/initial_root_token
+
+CERT_BASE=shortttl.${DEMO_DOMAIN}
+
+# We want these to just keep running on their own when wrapped in pe calls
+NO_WAIT=true
+while true;do
+    echo "$(date +%H:%M:%S): Renewing Certificate"
+    issue_cert ${CERT_BASE} 60 pki_int_main short-ttl-${ROOT_ROLE}
+    sleep 30
+done
+
diff --git a/secrets/pki/vagrant/demo/demo4_revoke_cert.sh b/secrets/pki/vagrant/demo/demo4_revoke_cert.sh
new file mode 100755
index 00000000..40ca09b9
--- /dev/null
+++ b/secrets/pki/vagrant/demo/demo4_revoke_cert.sh
@@ -0,0 +1,14 @@
+# Source in default environment variables
+. /demo/default_env.sh
+
+# Source in all functions
+. /demo/vault_demo_functions.sh 
+
+VAULT_USE_TLS=true
+VAULT_ADDR=https://${VAULT_HOST}:${VAULT_PORT}
+
+. /demo/initial_root_token
+
+PKI_PATH=pki_int_main
+CERT_BASE=shortttl.${DEMO_DOMAIN}
+revoke ${PKI_PATH} $(cat /var/tmp/${CERT_BASE}.serial)
diff --git a/secrets/pki/vagrant/demo/demo5_consul_template_renew.sh b/secrets/pki/vagrant/demo/demo5_consul_template_renew.sh
new file mode 100755
index 00000000..b01d3e4f
--- /dev/null
+++ b/secrets/pki/vagrant/demo/demo5_consul_template_renew.sh
@@ -0,0 +1,39 @@
+# Source in default environment variables
+. /demo/default_env.sh
+
+# Source in all functions
+. /demo/vault_demo_functions.sh 
+
+VAULT_USE_TLS=true
+VAULT_ADDR=https://${VAULT_HOST}:${VAULT_PORT}
+
+. /demo/initial_root_token
+COMMON_NAME=shortttl.${DEMO_DOMAIN}
+TTL=60
+ROLE=short-ttl-${ROOT_ROLE}
+PKI_PATH=${INTERMEDIATE_CA_PATH}
+
+# Only try to create the role if it doesn't exist
+vault read ${INTERMEDIATE_CA_PATH}/roles/${ROLE} &> /dev/null
+if [ $? -gt 0 ];then
+  create_role ${ROLE} ${INTERMEDIATE_CA_PATH} ${DEMO_DOMAIN} ${INTERMEDIATE_CERT_TTL}
+fi
+
+create_issue_policy ${ROLE} ${PKI_PATH} ${ROOT_PKI_PATH}
+echo $(green "Current vault token: ${VAULT_TOKEN}")
+echo $(yellow "Shifting to lower privileged token")
+# This sets the $TOKEN variable internally
+create_token ${ROLE} ${DEFAULT_TOKEN_TTL}
+VAULT_TOKEN=$(cat ${LOCAL_MOUNT}/token-${ROLE})
+echo $(green "Current vault token: ${VAULT_TOKEN}")
+create_pki_consul_templates
+# This env comes from the function above
+pe "/opt/bin/consul-template -config=${CONSUL_TMPL_PKI}" & 
+
+
+echo $(yellow "Testing certificate validity using openssl")
+while true;do
+  echo -n "$(date +%H:%M:%S): Verifying Certificate: " 
+  verify ${COMMON_NAME}
+  sleep 5
+done
diff --git a/secrets/pki/vagrant/demo/tokens/short-ttl-hashidemos-com b/secrets/pki/vagrant/demo/tokens/short-ttl-hashidemos-com
new file mode 100644
index 00000000..8dde46a4
--- /dev/null
+++ b/secrets/pki/vagrant/demo/tokens/short-ttl-hashidemos-com
@@ -0,0 +1,4 @@
+
+vault token create -policy=short-ttl-hashidemos-com -field=token -ttl=120s
+
+5cb39547-4b8a-4bd9-b77c-de95c8a52869
diff --git a/secrets/pki/vagrant/demo/vault_demo_functions.sh b/secrets/pki/vagrant/demo/vault_demo_functions.sh
new file mode 100644
index 00000000..944af419
--- /dev/null
+++ b/secrets/pki/vagrant/demo/vault_demo_functions.sh
@@ -0,0 +1,361 @@
+if [[ -z ${DEMO_WAIT} ]];then
+  DEMO_WAIT=0
+fi
+
+. /demo/demo-magic.sh -d -p -w ${DEMO_WAIT}
+
+VAULT_CACERT=/etc/certs/${VAULT_HOST}_ca_chain_full.pem
+VAULT_CLIENT_CERT=/etc/certs/${VAULT_HOST}_crt.pem
+VAULT_CLIENT_KEY=/etc/certs/${VAULT_HOST}_key.pem
+VAULT_TOKEN=${VAULT_TOKEN}
+ 
+vault () {
+  # Wrapper to run vault command line from docker instance.   Use local mount
+  # for storing arbitrary data loaded on the local system
+  if [ -n "${VAULT_USE_TLS}" ];then
+    AUTH_ENV="-e VAULT_CACERT=${VAULT_CACERT} \
+              -e VAULT_CLIENT_CERT=${VAULT_CLIENT_CERT} \
+              -e VAULT_CLIENT_KEY=${VAULT_CLIENT_KEY} \
+              -e VAULT_ADDR=https://${VAULT_HOST}:${VAULT_PORT} \
+              -e VAULT_TOKEN=${VAULT_TOKEN} \
+              -v /etc/certs:/etc/certs"
+  else
+    AUTH_ENV="-e VAULT_TOKEN=${VAULT_TOKEN} \
+              -e VAULT_ADDR=http://${VAULT_HOST}:${VAULT_PORT}"
+
+  fi
+  if [ -n "${VAULT_PIPE}" ];then
+    OPTIONS="${OPTIONS} -t"
+  fi
+  VAULT_IP=$(docker inspect ${VAULT_DOCKER} | jq .[0].NetworkSettings.Networks.bridge.IPAddress | tr -d '"')
+
+  docker run  \
+    --cap-add=IPC_LOCK --rm \
+    ${AUTH_ENV} \
+    -v ${LOCAL_MOUNT}:${DOCKER_MOUNT} \
+    --add-host ${VAULT_HOST}:${VAULT_IP} \
+    ${VAULT_IMAGE} $@
+}
+
+vault_dev_server () {
+    # Run an in memory vault server.   This should only be used for bootstrapping, but could be used for other testing as well.
+    docker rm dev-vault
+    docker run  \
+    --cap-add=IPC_LOCK --rm \
+    -v ${LOCAL_MOUNT}:${DOCKER_MOUNT} \
+    --name dev-vault \
+    --add-host ${VAULT_HOST}:172.18.0.2 \
+    ${VAULT_IMAGE} 
+}
+
+revoke () {
+  # Revoke a certificate and place an entry in the CRL hosted in Vault
+  PKI_PATH=$1
+  SERIAL=$2
+   
+  CURL_CERTS=''
+  if [ -n "${VAULT_USE_TLS}" ];then
+    CURL_CERTS="--cacert /etc/certs/${VAULT_HOST}_ca_chain_full.pem  --cert /etc/certs/${VAULT_HOST}_crt.pem --key /etc/certs/${VAULT_HOST}_key.pem"
+    VAULT_ADDR=https://${VAULT_HOST}:${VAULT_PORT}
+  fi
+
+  echo "{
+    \"serial_number\" : \"${SERIAL}\"
+  }" > ${LOCAL_INPUT_PARAMS}
+
+
+  echo $(green "Revoking from ${PKI_PATH} serial ${SERIAL}")
+  curl -s \
+    --header "X-Vault-Token: ${VAULT_TOKEN}" \
+    ${CURL_CERTS} \
+    --request POST \
+    --data @${LOCAL_INPUT_PARAMS} \
+    ${VAULT_ADDR}/v1/${PKI_PATH}/revoke 
+
+  echo $(green "Checking CRL")
+  curl -s \
+    --header "X-Vault-Token: ${VAULT_TOKEN}" \
+    ${CURL_CERTS} \
+    --request GET \
+    ${VAULT_ADDR}/v1/${PKI_PATH}/crl/pem | openssl crl -inform PEM -text -noout
+
+}
+
+bootstrap_ca () {
+  
+  # Bootstraps CA and initial client certificates for securing Vault with TLS
+
+  CURL_CERTS=''
+  if [ -n "${VAULT_USE_TLS}" ];then
+    CURL_CERTS="--cacert /etc/certs/${VAULT_HOST}_ca_chain_full.pem  --cert /etc/certs/${VAULT_HOST}_crt.pem --key /etc/certs/${VAULT_HOST}_key.pem"
+    VAULT_ADDR=https://${VAULT_HOST}:${VAULT_PORT}
+  fi
+
+  # Allow for certificate stores
+  echo $(green "Enabling CA Certificate PKI Secret Engine")
+  pe "vault secrets enable -path=${ROOT_PKI_PATH} pki"
+
+  # Set max lease time for root pki setup
+  echo $(green "Tuning CA Certificate PKI Secret Engine")
+  pe "vault secrets tune -max-lease-ttl=${ROOT_CERT_TTL} ${ROOT_PKI_PATH}"
+
+  #  ttl=${ROOT_CERT_TTL}
+
+  # Use the HTTP API versus the command version due to quote removal when passing bash arguments with quotes in them.
+  echo "{
+    \"common_name\" : \"${ROOT_DOMAIN} CA 1\",
+    \"ttl\"         : \"${ROOT_CERT_TTL}\"
+  }" > ${LOCAL_INPUT_PARAMS}
+
+  OUTPUT_FILE=${LOCAL_MOUNT}/root_ca_output.json
+  echo $(green "Generating CA Root certificate.  JSON output found at ${OUTPUT_FILE}")
+  pe "curl -s \
+    --header \"X-Vault-Token: ${VAULT_TOKEN}\" \
+    ${CURL_CERTS} \
+    --request POST \
+    --data @${LOCAL_INPUT_PARAMS} \
+    ${VAULT_ADDR}/v1/${ROOT_PKI_PATH}/root/generate/internal > ${OUTPUT_FILE}"
+
+  jq -r '.data.certificate' ${OUTPUT_FILE} > ${LOCAL_MOUNT}/CA_cert.pem
+  jq -r '.data.serial_number' ${OUTPUT_FILE} > ${LOCAL_MOUNT}/CA_cert.serial
+
+  # Cert CRL and CA information
+  echo $(green "Updating CRL And CA information")
+  pe "vault write ${ROOT_PKI_PATH}/config/urls \
+    issuing_certificates=${VAULT_ADDR}/v1/${ROOT_PKI_PATH}/ca \
+    crl_distribution_points=${VAULT_ADDR}/v1/${ROOT_PKI_PATH}/crl"
+
+  # Abstracting name for re-usability
+  PKI_PATH=pki_int_main
+  MAX_TTL=${INTERMEDIATE_CERT_TTL}
+
+  # Setup intermediate CA endpoint
+  echo $(green "Enabling PKI Secret Engine at ${PKI_PATH}")
+  pe "vault secrets enable -path=${PKI_PATH} pki"
+
+  # Set max lease time for pki
+  echo $(green "Tuning PKI Secret Engine ${PKI_PATH}")
+  pe "vault secrets tune -max-lease-ttl=${MAX_TTL} ${PKI_PATH}"
+
+  # Use the HTTP API versus the command version due to quote removal when passing bash arguments with quotes in them into functions like the docker run
+  echo "{
+    \"common_name\" : \"${ROOT_DOMAIN} Intermediate 1\",
+    \"ttl\"         : \"${MAX_TTL}\"
+  }" > ${LOCAL_INPUT_PARAMS}
+
+  OUTPUT_FILE=${LOCAL_MOUNT}/intermediate_csr_output.json
+  echo $(green "Generating Intermediate CSR.  JSON output found at ${OUTPUT_FILE}")
+  echo $(green "CSR located at ${LOCAL_MOUNT}/${PKI_PATH}.csr")
+  pe "curl -s \
+    --header \"X-Vault-Token: ${VAULT_TOKEN}\" \
+    ${CURL_CERTS} \
+    --request POST \
+    --data @${LOCAL_INPUT_PARAMS} \
+    ${VAULT_ADDR}/v1/${PKI_PATH}/intermediate/generate/internal \
+    > ${OUTPUT_FILE}"
+
+  jq -r '.data.csr' ${OUTPUT_FILE} > ${LOCAL_MOUNT}/${PKI_PATH}.csr
+
+  # Sign the intermediate cert with the root cert and save the cert file locally.
+  OUTPUT_FILE=${LOCAL_MOUNT}/intermediate_csr_output.json
+  echo $(green "Generating Intermediate PEM cert.  JSON output found at ${OUTPUT_FILE}")
+  echo $(green "Certificate located at ${LOCAL_MOUNT}/${PKI_PATH}.pem")
+  pe "vault write -format=json ${ROOT_PKI_PATH}/root/sign-intermediate \
+    csr=@${DOCKER_MOUNT}/${PKI_PATH}.csr \
+    format=pem_bundle \
+    > ${OUTPUT_FILE}"
+
+  pe "jq -r '.data.certificate' ${OUTPUT_FILE} > ${LOCAL_MOUNT}/${PKI_PATH}.pem"
+
+  # Set the intermediate certificate authorities signing certificate to the root-signed certificate.
+  pe "vault write ${PKI_PATH}/intermediate/set-signed certificate=@${DOCKER_MOUNT}/${PKI_PATH}.pem"
+
+  # Cert URL metadata
+  echo $(green "Updating CRL And CA information for ${PKI_PATH}")
+  pe "vault write ${PKI_PATH}/config/urls \
+    issuing_certificates=${VAULT_ADDR}/v1/${PKI_PATH}/ca \
+    crl_distribution_points=${VAULT_ADDR}/v1/${PKI_PATH}/crl"
+}
+
+create_role () {
+  # Roles have permissions to create certificates for certain domains
+  # This process creates leases which are probably not necessary for short-lived TTLs
+  PRE_ROLE=${1:-$PKI_ROLE}
+  ROLE=${PRE_ROLE//./-}
+  LOCAL_PATH=${2:-$PKI_PATH}
+  DOMAINS=${3:-$PKI_DOMAIN}
+  MAX_TTL=${4:-$PKI_MAX_TTL}
+
+  echo $(green "Creating role ${ROLE} in ${LOCAL_PATH}")
+  pe "vault write ${LOCAL_PATH}/roles/${ROLE} \
+      allowed_domains=${DOMAINS} \
+      allow_subdomains=true \
+      max_ttl=${MAX_TTL} \
+      allow_any_name=true \
+      generate_lease=true \
+      enforce_hostnames=false"
+}
+
+create_issue_policy () {
+  POLICY_NAME=${1:-$POLICY_NAME}
+  PKI_PATH=${2:-$PKI_PATH}
+  ROOT_PATH=${3:-$ROOT_PKI_PATH}
+
+  echo $(green "Creating policy to assign to token(s)")
+  pe "cat > ${LOCAL_MOUNT}/policy-${POLICY_NAME} << EOF 
+path \"${PKI_PATH}/issue*\" {
+    capabilities = [\"create\",\"update\"]
+}
+
+path \"${ROOT_PATH}/cert/ca\" {
+    capabilities = [\"read\"]
+}
+
+path \"auth/token/renew\" {
+    capabilities = [\"update\"]
+}
+
+path \"auth/token/renew-self\" {
+    capabilities = [\"update\"]
+}
+EOF"
+ pe "vault policy write ${POLICY_NAME} ${DOCKER_MOUNT}/policy-${POLICY_NAME}"
+}
+
+create_token () {
+  POLICY_NAME=${1:-$POLICY_NAME}
+  TTL=${2:-$DEFAULT_TOKEN_TTL}
+
+  # This is a single policy token.  For this demo, that works.  
+  echo $(green "Creating token with single policy into ${LOCAL_MOUNT}/token-${POLICY_NAME}")
+  pe "vault token create -policy=${POLICY_NAME} -field=token -ttl=${TTL} > ${LOCAL_MOUNT}/token-${POLICY_NAME}"
+}
+
+issue_cert () {
+  DOMAIN=${1:-$PKI_DOMAIN}
+  TTL=${2:-$PKI_MAX_TTL}
+  LOCAL_PATH=${3:-$PKI_PATH}
+  PRE_ROLE=${4:-$PKI_ROLE}
+  ROLE=${PRE_ROLE//./-}
+
+  # Issue the certificates
+  OUTPUT_FILE=${LOCAL_MOUNT}/${DOMAIN}_cert.json
+  echo $(green "Creating cert for ${DOMAIN}.  JSON Output: ${OUTPUT_FILE}")
+  pe "vault write -format=json ${LOCAL_PATH}/issue/${ROLE} \
+      common_name=${DOMAIN} \
+      ttl=${TTL} > ${OUTPUT_FILE}"
+
+ 
+  # These are being written out to the filesystem, but could easily just be consumed 
+  # in memory by any API
+  echo $(green "Writing CA Chain ${LOCAL_MOUNT}/${DOMAIN}_ca_chain.pem")
+  jq -r .data.ca_chain[0] ${OUTPUT_FILE} > ${LOCAL_MOUNT}/${DOMAIN}_ca_chain.pem
+  echo $(green "Writing Full CA Chain ${LOCAL_MOUNT}/${DOMAIN}_ca_chain_full.pem")
+  cat ${LOCAL_MOUNT}/${DOMAIN}_ca_chain.pem ${LOCAL_MOUNT}/CA_cert.pem > ${LOCAL_MOUNT}/${DOMAIN}_ca_chain_full.pem
+  echo $(green "Writing cert ${LOCAL_MOUNT}/${DOMAIN}_crt.pem")
+  jq -r .data.certificate ${OUTPUT_FILE} > ${LOCAL_MOUNT}/${DOMAIN}_crt.pem
+  echo $(green "Writing private key ${LOCAL_MOUNT}/${DOMAIN}_key.pem")
+  jq -r .data.private_key ${OUTPUT_FILE} > ${LOCAL_MOUNT}/${DOMAIN}_key.pem
+  echo $(green "Writing serial ${LOCAL_MOUNT}/${DOMAIN}.serial")
+  jq -r .data.serial_number ${OUTPUT_FILE} > ${LOCAL_MOUNT}/${DOMAIN}.serial
+  echo
+
+}
+
+verify () {
+  # Check the validity of a cert
+  CA_FILE=${LOCAL_MOUNT}/$1_ca_chain_full.pem
+  CERT=${LOCAL_MOUNT}/$1_crt.pem
+  openssl verify -CAfile ${CA_FILE} ${CERT} | grep error &> /dev/null
+  if [[ $? -eq 0 ]];then
+    STATUS=$(red "invalid")
+  else
+    STATUS=$(green "valid")
+  fi
+  echo "Certificate ${CERT} is ${STATUS}"
+}
+
+create_pki_consul_templates () {
+  COMMON_NAME=${1:-$COMMON_NAME}
+  TTL=${2:-$TTL}
+  PRE_ROLE=${3:-$ROLE}
+  ROLE=${PRE_ROLE//./-}
+  ROOT_PATH=${4:-$ROOT_PKI_PATH}
+  PKI_PATH=${5:-$INTERMEDIATE_CA_PATH}
+
+  CONSUL_TMPL_PKI_DIR=/etc/consul_templates/pki
+  PREFIX=${CONSUL_TMPL_PKI_DIR}/${COMMON_NAME}
+  CA_TMPL=${PREFIX}/ca.tmpl
+  CERT_TMPL=${PREFIX}/cert.tmpl
+  KEY_TMPL=${PREFIX}/key.tmpl
+  SERIAL_TMPL=${PREFIX}/serial.tmpl
+  CONSUL_TMPL_PKI=${PREFIX}/consul_template.tmpl
+
+  # This is a no wait zone
+  echo $(yellow "Removing demo prompt waits for this section")
+  PROMPT_TIMEOUT_ORIG=${DEMO_WAIT}
+  PROMPT_TIMEOUT=3
+
+  mkdir -p ${PREFIX}
+
+  echo $(green "Creating consul-template templates")
+  cat > ${CERT_TMPL} <<EOA
+{{- with secret "${PKI_PATH}/issue/${ROLE}" "common_name=${COMMON_NAME}" "ttl=${TTL}" -}}
+{{ .Data.certificate }}{{ end }}
+EOA
+  pe "cat ${CERT_TMPL}"
+  cat > ${CA_TMPL} <<EOB
+{{ with secret "${ROOT_PATH}/cert/ca" -}}
+{{ .Data.certificate }}{{ end }}
+{{ with secret "${PKI_PATH}/issue/${ROLE}" "common_name=${COMMON_NAME}" "ttl=${TTL}" -}}
+{{ .Data.issuing_ca }}{{ end }}
+EOB
+  pe "cat ${CA_TMPL}"
+
+  cat > ${KEY_TMPL} <<EOC
+{{ with secret "${PKI_PATH}/issue/${ROLE}" "common_name=${COMMON_NAME}" "ttl=${TTL}" -}}
+{{ .Data.private_key }}{{ end }}
+EOC
+  pe "cat ${KEY_TMPL}"
+
+  cat > ${SERIAL_TMPL} <<EOD
+{{ with secret "${PKI_PATH}/issue/${ROLE}" "common_name=${COMMON_NAME}" "ttl=${TTL}" -}}
+{{ .Data.serial_number }}{{ end }}
+EOD
+  pe "cat ${SERIAL_TMPL}"
+
+  echo $(green "Creating consul-template config file")
+  cat > ${CONSUL_TMPL_PKI} <<EOF
+  vault {
+    address = "https://${VAULT_HOST}:8200"
+    token = "${VAULT_TOKEN}"
+    ssl {
+      cert    = "${VAULT_CLIENT_CERT}"
+      key     = "${VAULT_CLIENT_KEY}"
+      ca_cert = "${VAULT_CACERT}"
+    }
+  }
+  template {
+    source      = "${CERT_TMPL}"
+    destination = "${LOCAL_MOUNT}/${COMMON_NAME}_crt.pem"
+  }
+
+  template {
+    source      = "${KEY_TMPL}"
+    destination = "${LOCAL_MOUNT}/${COMMON_NAME}_key.pem"
+  }
+
+  template {
+    source      = "${CA_TMPL}"
+    destination = "${LOCAL_MOUNT}/${COMMON_NAME}_ca_chain_full.pem"
+  }
+
+  template {
+    source      = "${SERIAL_TMPL}"
+    destination = "${LOCAL_MOUNT}/${COMMON_NAME}.serial"
+  }
+EOF
+  pe "cat ${CONSUL_TMPL_PKI}"
+  echo $(yellow "Restoring demo prompt waits")
+  PROMPT_TIMEOUT=${PROMPT_TIMEOUT_ORIG}
+}
diff --git a/secrets/pki/vagrant/run_me_first.sh b/secrets/pki/vagrant/run_me_first.sh
new file mode 100755
index 00000000..8d641780
--- /dev/null
+++ b/secrets/pki/vagrant/run_me_first.sh
@@ -0,0 +1,152 @@
+#!/bin/bash
+# 
+# generate-provisioners.sh
+#
+# PURPOSE: Generates the user-data file used by Vagrant by sourcing environment variables in demo/default_env.sh.   This allows for easily updating consul and vault versions without having to re-write versions directly.
+
+. demo/default_env.sh
+
+cat > provision.sh <<EOL
+. /demo/default_env.sh
+
+IP=\$(ip -f inet addr show eth1 | grep -Po 'inet \K[\d.]+')
+echo \${IP} vault1.\${DEMO_DOMAIN} >> /etc/hosts
+
+mkdir -p /etc/vault
+cat > /etc/vault/config.hcl <<EOF
+storage "consul" {
+  address = "\${IP}:8500"
+  path    = "vault"
+}
+
+listener "tcp" {
+  address            = "0.0.0.0:8200"
+  tls_cert_file      = "/etc/certs/\${VAULT_HOST}_crt.pem"
+  tls_key_file       = "/etc/certs/\${VAULT_HOST}_key.pem"
+  tls_client_ca_file = "/etc/certs/\${VAULT_HOST}_ca_chain.pem"
+}
+EOF
+
+mkdir -p /etc/bash/bashrc.d
+echo "alias ll='ls -latr'" >> /etc/bash/bashrc.d/jake_preferences
+echo "set -o vi" >> /etc/bash/bashrc.d/jake_preferences
+
+mkdir -p /opt/bin
+cd /opt/bin
+wget -q ${CONSUL_TEMPLATE_URL} && tar -xzvf ${CONSUL_TEMPLATE_BIN} && chmod 0755 consul-template
+EOL
+
+cat > user-data <<EOF 
+#cloud-config
+
+systemd:
+  units:
+    - name: update-engine.service
+      mask: true
+    - name: locksmithd.service
+      mask: true
+
+coreos:
+  update:
+    reboot-strategy: off
+  units:
+   - name: docker-consul.service
+     enable: true
+     command: start
+     content: |
+       [Unit]
+       Description=Daemon for consul
+       After=docker.service
+       Requires=docker.service
+       
+       [Service]
+       Restart=on-failure
+       StartLimitInterval=20
+       StartLimitBurst=5
+       TimeoutStartSec=0
+       Environment="HOME=/root"
+       ExecStartPre=-/usr/bin/docker kill consul
+       ExecStartPre=-/usr/bin/docker rm consul
+       ExecStartPre=-/usr/bin/docker pull ${CONSUL_IMAGE}
+       ExecStart=/usr/bin/docker run \\
+         --rm \\
+         --net bridge -m 0b \\
+         -p 8300:8300 -p 8301:8301 -p 8301:8301/udp \\
+         -p 8302:8302 -p 8302:8302/udp -p 8400:8400 \\
+         -p 8500:8500 \\
+         -v /var/consul/data:/consul/data \\
+         -v /etc/certs:/etc/certs \\
+         -h ${CONSUL_HOST} \\
+         --name consul \\
+         ${CONSUL_IMAGE} agent -ui \\
+         -node=${CONSUL_HOST} -datacenter=dev -advertise=172.17.8.101 \\
+         -bind=0.0.0.0 -client=0.0.0.0 -encrypt=D8Er0YYpXOkM4QFm0eErFw== \\
+         -data-dir=/consul/data -config-dir=/consul/config  -bootstrap-expect=1 -server
+       
+       ExecStop=-/usr/bin/docker stop -t 45 consul
+       
+       [Install]
+       WantedBy=multi-user.target
+
+   - name: docker-vault.service
+     enable: true
+     content: |
+       [Unit]
+       Description=Daemon for vault
+       After=docker.service
+       Requires=docker.service
+       
+       [Service]
+       Restart=on-failure
+       StartLimitInterval=20
+       StartLimitBurst=5
+       TimeoutStartSec=0
+       Environment="HOME=/root"
+       ExecStartPre=-/usr/bin/docker kill vault
+       ExecStartPre=-/usr/bin/docker rm vault
+       ExecStartPre=-/usr/bin/docker pull ${VAULT_IMAGE}
+       ExecStart=/usr/bin/docker run \\
+         --net bridge -m 0b \\
+         --log-driver=json-file --log-opt max-size=50m --log-opt max-file=10 \\
+         -p 8200:8200 \\
+         -v /etc/certs:/etc/certs \\
+         -v /etc/vault:/vault/config \\
+         --name vault \\
+         --cap-add=IPC_LOCK \\
+         ${VAULT_IMAGE} vault server -config /vault/config
+       
+       ExecStop=-/usr/bin/docker stop -t 45 vault
+       
+       [Install]
+       WantedBy=multi-user.target
+
+   - name: docker-vault-dev.service
+     enable: true
+     content: |
+       [Unit]
+       Description=Dev Daemon for vault
+       After=docker.service
+       Requires=docker.service
+       
+       [Service]
+       Restart=on-failure
+       StartLimitInterval=20
+       StartLimitBurst=5
+       TimeoutStartSec=0
+       Environment="HOME=/root"
+       ExecStartPre=-/usr/bin/docker kill dev-vault
+       ExecStartPre=-/usr/bin/docker rm dev-vault
+       ExecStartPre=-/usr/bin/docker pull ${VAULT_IMAGE}
+       ExecStart=/usr/bin/docker run \\
+         --net bridge -m 0b \\
+         -p 8200:8200 \\
+         --name dev-vault \\
+         --cap-add=IPC_LOCK \\
+         ${VAULT_IMAGE} server -dev
+       
+       ExecStop=-/usr/bin/docker stop -t 45 dev-vault
+       
+       [Install]
+       WantedBy=multi-user.target
+EOF
+

From 237a97a3aa98207d9a69cd946d0c0b01487d353c Mon Sep 17 00:00:00 2001
From: Jake Lundberg <grove.mountain.github@nym.hush.com>
Date: Mon, 11 Jun 2018 12:47:45 -0700
Subject: [PATCH 2/2] add-pki-guide: minor text move

---
 secrets/pki/vagrant/demo/default_env.sh | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/secrets/pki/vagrant/demo/default_env.sh b/secrets/pki/vagrant/demo/default_env.sh
index e87348f7..3b5baf0f 100644
--- a/secrets/pki/vagrant/demo/default_env.sh
+++ b/secrets/pki/vagrant/demo/default_env.sh
@@ -1,12 +1,11 @@
 # These are all the defaults for any environment variables below.  Setting environment variables before accessing this set of defaults will override anything set here.
+DEFAULT_ROOT_DOMAIN=hashidemos.com
 
 # Software versions.   These are probably the only values that should change over time
 DEFAULT_VAULT_VERSION=0.10.1
 DEFAULT_CONSUL_VERSION=1.0.6
 DEFAULT_CONSUL_TEMPLATE_VERSION=0.19.4
 
-DEFAULT_ROOT_DOMAIN=hashidemos.com
-
 DEFAULT_ROOT_PKI_PATH=pki_root
 DEFAULT_VAULT_PORT=8200
 DEFAULT_ROOT_CERT_TTL=87648h
@@ -17,7 +16,6 @@ DEFAULT_TOKEN_TTL=120s
 DEFAULT_LOCAL_MOUNT=/var/tmp
 DEFAULT_DOCKER_MOUNT=/var/tmp/docker
 
-
 ROOT_PKI_PATH=${ROOT_PKI_PATH:-$DEFAULT_ROOT_PKI_PATH}
 ROOT_DOMAIN=${ROOT_DOMAIN:-$DEFAULT_ROOT_DOMAIN}
 DEMO_DOMAIN=dev.${ROOT_DOMAIN}