tech/sxchnge
1
0 Fork 0
Code Issues 6 Pull Requests 1 Actions Packages Projects 1 Releases Wiki Activity

Match the platform Vault on UI, mlock and the TLS flag

Browse Source 
The UI stays reachable on the private addresses only. Integrated raft storage runs with mlock disabled, as on the platform Vault and as Vault recommends for raft.
This commit is contained in:
protuberanets committed 2026-10-29 20:07:22 +03:00
1 parent f436b2528c
commit 2f74d3627e
3 files changed
+9 -9
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

infra/prod/vault/config/vault-1.hcl
+3 -3
View File
@@ -1,7 +1,7 @@
# SXCHNGE production Vault, node 1. Only api_addr, cluster_addr and node_id # SXCHNGE production Vault, node 1. Only api_addr, cluster_addr and node_id
# differ between the three node files. # differ between the three node files.
ui = false ui = true
disable_mlock = false disable_mlock = true
api_addr = "http://192.168.10.191:8200" api_addr = "http://192.168.10.191:8200"
cluster_addr = "https://192.168.10.191:8201" cluster_addr = "https://192.168.10.191:8201"
@@ -10,7 +10,7 @@ listener "tcp" {
cluster_address = "0.0.0.0:8201" cluster_address = "0.0.0.0:8201"
# Plain HTTP on the private network; raft and request forwarding on the # Plain HTTP on the private network; raft and request forwarding on the
# cluster port are encrypted by Vault itself. # cluster port are encrypted by Vault itself.
tls_disable = true tls_disable = 1
} }
storage "raft" { storage "raft" {
infra/prod/vault/config/vault-2.hcl
+3 -3
View File
@@ -1,7 +1,7 @@
# SXCHNGE production Vault, node 2. Only api_addr, cluster_addr and node_id # SXCHNGE production Vault, node 2. Only api_addr, cluster_addr and node_id
# differ between the three node files. # differ between the three node files.
ui = false ui = true
disable_mlock = false disable_mlock = true
api_addr = "http://192.168.10.191:8210" api_addr = "http://192.168.10.191:8210"
cluster_addr = "https://192.168.10.191:8211" cluster_addr = "https://192.168.10.191:8211"
@@ -10,7 +10,7 @@ listener "tcp" {
cluster_address = "0.0.0.0:8201" cluster_address = "0.0.0.0:8201"
# Plain HTTP on the private network; raft and request forwarding on the # Plain HTTP on the private network; raft and request forwarding on the
# cluster port are encrypted by Vault itself. # cluster port are encrypted by Vault itself.
tls_disable = true tls_disable = 1
} }
storage "raft" { storage "raft" {
infra/prod/vault/config/vault-3.hcl
+3 -3
View File
@@ -1,7 +1,7 @@
# SXCHNGE production Vault, node 3. Only api_addr, cluster_addr and node_id # SXCHNGE production Vault, node 3. Only api_addr, cluster_addr and node_id
# differ between the three node files. # differ between the three node files.
ui = false ui = true
disable_mlock = false disable_mlock = true
api_addr = "http://192.168.10.98:8200" api_addr = "http://192.168.10.98:8200"
cluster_addr = "https://192.168.10.98:8201" cluster_addr = "https://192.168.10.98:8201"
@@ -10,7 +10,7 @@ listener "tcp" {
cluster_address = "0.0.0.0:8201" cluster_address = "0.0.0.0:8201"
# Plain HTTP on the private network; raft and request forwarding on the # Plain HTTP on the private network; raft and request forwarding on the
# cluster port are encrypted by Vault itself. # cluster port are encrypted by Vault itself.
tls_disable = true tls_disable = 1
} }
storage "raft" { storage "raft" {