tech/sxchnge
1
0 Fork 0
Code Issues 6 Pull Requests 1 Actions Packages Projects 1 Releases Wiki Activity

Keep the production Vault private and reach its UI through SSH

Browse Source
This commit is contained in:
protuberanets committed 2026-10-29 21:07:59 +03:00
1 parent 2f74d3627e
commit 1b9a89d9c4
1 file changed
+4
Download Patch File Download Diff File Expand all files Collapse all files
infra/prod/README.md
+4
View File
@@ -25,6 +25,10 @@ Containers on `exch` join the Docker network `sxchnge` and use
`http://vault:8200`; the alias belongs to both local nodes. A standby node `http://vault:8200`; the alias belongs to both local nodes. A standby node
forwards requests to the active one, so the leader may be on any server. forwards requests to the active one, so the leader may be on any server.
Vault is not published to the internet. Its UI is opened through an SSH tunnel
from an administrator's machine, for example
`ssh -N -L 8200:192.168.10.191:8200 exch` and then `http://localhost:8200/ui`.
Nodes unseal themselves with the `transit` seal on the platform Vault Nodes unseal themselves with the `transit` seal on the platform Vault
(`https://vault.sendico.io`, key `transit/keys/sxchnge-vault-unseal`). Each server (`https://vault.sendico.io`, key `transit/keys/sxchnge-vault-unseal`). Each server
has its own periodic token in `secrets/transit-token` (root, mode 600, not in Git) has its own periodic token in `secrets/transit-token` (root, mode 600, not in Git)