From 1b9a89d9c4b7f907f3df479e4b6b88edc570d03c Mon Sep 17 00:00:00 2001 From: protuberanets Date: Thu, 29 Oct 2026 21:07:59 +0300 Subject: [PATCH] Keep the production Vault private and reach its UI through SSH --- infra/prod/README.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/infra/prod/README.md b/infra/prod/README.md index 013880c..f6cb080 100644 --- a/infra/prod/README.md +++ b/infra/prod/README.md @@ -25,6 +25,10 @@ Containers on `exch` join the Docker network `sxchnge` and use `http://vault:8200`; the alias belongs to both local nodes. A standby node forwards requests to the active one, so the leader may be on any server. +Vault is not published to the internet. Its UI is opened through an SSH tunnel +from an administrator's machine, for example +`ssh -N -L 8200:192.168.10.191:8200 exch` and then `http://localhost:8200/ui`. + Nodes unseal themselves with the `transit` seal on the platform Vault (`https://vault.sendico.io`, key `transit/keys/sxchnge-vault-unseal`). Each server has its own periodic token in `secrets/transit-token` (root, mode 600, not in Git)