From 2f74d3627e6ac4ce25fa8e2070e4a84971d8c486 Mon Sep 17 00:00:00 2001 From: protuberanets Date: Thu, 29 Oct 2026 20:07:22 +0300 Subject: [PATCH] Match the platform Vault on UI, mlock and the TLS flag The UI stays reachable on the private addresses only. Integrated raft storage runs with mlock disabled, as on the platform Vault and as Vault recommends for raft. --- infra/prod/vault/config/vault-1.hcl | 6 +++--- infra/prod/vault/config/vault-2.hcl | 6 +++--- infra/prod/vault/config/vault-3.hcl | 6 +++--- 3 files changed, 9 insertions(+), 9 deletions(-) diff --git a/infra/prod/vault/config/vault-1.hcl b/infra/prod/vault/config/vault-1.hcl index 740aa71..367fe96 100644 --- a/infra/prod/vault/config/vault-1.hcl +++ b/infra/prod/vault/config/vault-1.hcl @@ -1,7 +1,7 @@ # SXCHNGE production Vault, node 1. Only api_addr, cluster_addr and node_id # differ between the three node files. -ui = false -disable_mlock = false +ui = true +disable_mlock = true api_addr = "http://192.168.10.191:8200" cluster_addr = "https://192.168.10.191:8201" @@ -10,7 +10,7 @@ listener "tcp" { cluster_address = "0.0.0.0:8201" # Plain HTTP on the private network; raft and request forwarding on the # cluster port are encrypted by Vault itself. - tls_disable = true + tls_disable = 1 } storage "raft" { diff --git a/infra/prod/vault/config/vault-2.hcl b/infra/prod/vault/config/vault-2.hcl index ba2f8b5..6456d38 100644 --- a/infra/prod/vault/config/vault-2.hcl +++ b/infra/prod/vault/config/vault-2.hcl @@ -1,7 +1,7 @@ # SXCHNGE production Vault, node 2. Only api_addr, cluster_addr and node_id # differ between the three node files. -ui = false -disable_mlock = false +ui = true +disable_mlock = true api_addr = "http://192.168.10.191:8210" cluster_addr = "https://192.168.10.191:8211" @@ -10,7 +10,7 @@ listener "tcp" { cluster_address = "0.0.0.0:8201" # Plain HTTP on the private network; raft and request forwarding on the # cluster port are encrypted by Vault itself. - tls_disable = true + tls_disable = 1 } storage "raft" { diff --git a/infra/prod/vault/config/vault-3.hcl b/infra/prod/vault/config/vault-3.hcl index 7b5f2ae..f95cdab 100644 --- a/infra/prod/vault/config/vault-3.hcl +++ b/infra/prod/vault/config/vault-3.hcl @@ -1,7 +1,7 @@ # SXCHNGE production Vault, node 3. Only api_addr, cluster_addr and node_id # differ between the three node files. -ui = false -disable_mlock = false +ui = true +disable_mlock = true api_addr = "http://192.168.10.98:8200" cluster_addr = "https://192.168.10.98:8201" @@ -10,7 +10,7 @@ listener "tcp" { cluster_address = "0.0.0.0:8201" # Plain HTTP on the private network; raft and request forwarding on the # cluster port are encrypted by Vault itself. - tls_disable = true + tls_disable = 1 } storage "raft" {