vault: implement bootstrap integration

terraform/vault/pki.tf

@@ -16,7 +16,7 @@
 #
 # 1. ACME (Automated Certificate Management Environment)
 #    - Services fetch certificates automatically using ACME protocol
-#    - ACME directory: https://vault.home.2rjus.net:8200/v1/pki_int/acme/directory
+#    - ACME directory: https://vault01.home.2rjus.net:8200/v1/pki_int/acme/directory
 #    - Enable ACME: bao write pki_int/config/acme enabled=true
 #    - Compatible with cert-manager, lego, certbot, etc.
 #
@@ -149,7 +149,7 @@ locals {
   static_certificates = {
     # Example: Issue a certificate for a specific service
     # "vault" = {
-    #   common_name = "vault.home.2rjus.net"
+    #   common_name = "vault01.home.2rjus.net"
     #   alt_names   = ["vault01.home.2rjus.net"]
     #   ip_sans     = ["10.69.13.19"]
     #   ttl         = "8760h"  # 1 year
@@ -169,7 +169,7 @@ resource "vault_pki_secret_backend_cert" "static_certs" {
   ip_sans   = lookup(each.value, "ip_sans", [])
   ttl       = lookup(each.value, "ttl", "720h") # 30 days default
 
-  auto_renew = true
+  auto_renew            = true
   min_seconds_remaining = 604800 # Renew 7 days before expiry
 }
 
@@ -178,12 +178,12 @@ output "static_certificates" {
   description = "Static certificates issued by Vault PKI"
   value = {
     for k, v in vault_pki_secret_backend_cert.static_certs : k => {
-      common_name  = v.common_name
-      serial       = v.serial_number
-      expiration   = v.expiration
-      issuing_ca   = v.issuing_ca
-      certificate  = v.certificate
-      private_key  = v.private_key
+      common_name = v.common_name
+      serial      = v.serial_number
+      expiration  = v.expiration
+      issuing_ca  = v.issuing_ca
+      certificate = v.certificate
+      private_key = v.private_key
     }
   }
   sensitive = true