diff --git a/infra/prod/README.md b/infra/prod/README.md index f6cb080..83fdce8 100644 --- a/infra/prod/README.md +++ b/infra/prod/README.md @@ -1,11 +1,11 @@ # Production Production runs on two servers of the shared private network: `exch` -(192.168.10.191), the SXCHNGE server, and `infra-gamma` (192.168.10.98), which +(192.168.10.191), the production server, and `infra-gamma` (192.168.10.98), which keeps the third copy of the data. Each component runs two nodes on `exch` and one on `infra-gamma`: losing `infra-gamma` keeps the majority, losing one node on `exch` keeps two of three. Every server runs plain Docker Compose; files are -deployed to `/srv/sxchnge/` on the server. +deployed to `/srv/exch/` on the server. Ports are published on the private addresses only. Traffic between the servers is not wrapped in TLS: the network is private and limited by security groups, @@ -17,11 +17,11 @@ and every component authenticates its peers. | Node | Server | API | Cluster | Compose | | --- | --- | --- | --- | --- | -| `sxchnge-vault-1` | exch | 192.168.10.191:8200 | :8201 | `vault/exch.yml` | -| `sxchnge-vault-2` | exch | 192.168.10.191:8210 | :8211 | `vault/exch.yml` | -| `sxchnge-vault-3` | infra-gamma | 192.168.10.98:8200 | :8201 | `vault/gamma.yml` | +| `exch-vault-1` | exch | 192.168.10.191:8200 | :8201 | `vault/exch.yml` | +| `exch-vault-2` | exch | 192.168.10.191:8210 | :8211 | `vault/exch.yml` | +| `exch-vault-3` | infra-gamma | 192.168.10.98:8200 | :8201 | `vault/gamma.yml` | -Containers on `exch` join the Docker network `sxchnge` and use +Containers on `exch` join the Docker network `exch` and use `http://vault:8200`; the alias belongs to both local nodes. A standby node forwards requests to the active one, so the leader may be on any server. @@ -30,14 +30,14 @@ from an administrator's machine, for example `ssh -N -L 8200:192.168.10.191:8200 exch` and then `http://localhost:8200/ui`. Nodes unseal themselves with the `transit` seal on the platform Vault -(`https://vault.sendico.io`, key `transit/keys/sxchnge-vault-unseal`). Each server +(`https://vault.sendico.io`, key `transit/keys/exch-vault-unseal`). Each server has its own periodic token in `secrets/transit-token` (root, mode 600, not in Git) that may only encrypt and decrypt with that key. If the platform Vault is unreachable while a node starts, the node stays sealed until it is reachable again; running nodes are not affected. `vault operator init` returns recovery keys, not unseal keys: they authorize operations such as generating a new root token but cannot unseal a node. Only the transit key can. Its backup -(`transit/backup/sxchnge-vault-unseal`), the recovery keys and the root token are +(`transit/backup/exch-vault-unseal`), the recovery keys and the root token are kept outside the servers by their holders; see "Platform Vault lost". `make prod-images` resolves the latest stable Vault release and pins its digest in @@ -51,29 +51,29 @@ time. ```sh vault secrets list | grep -q '^transit/' || vault secrets enable transit - vault write transit/keys/sxchnge-vault-unseal exportable=true allow_plaintext_backup=true - vault read -field=backup transit/backup/sxchnge-vault-unseal # store with the holders, then clear the terminal - vault policy write sxchnge-vault-unseal - <<'EOF' - path "transit/encrypt/sxchnge-vault-unseal" { capabilities = ["update"] } - path "transit/decrypt/sxchnge-vault-unseal" { capabilities = ["update"] } + vault write transit/keys/exch-vault-unseal exportable=true allow_plaintext_backup=true + vault read -field=backup transit/backup/exch-vault-unseal # store with the holders, then clear the terminal + vault policy write exch-vault-unseal - <<'EOF' + path "transit/encrypt/exch-vault-unseal" { capabilities = ["update"] } + path "transit/decrypt/exch-vault-unseal" { capabilities = ["update"] } EOF ``` Create one token per server and write it straight into that server's - `/srv/sxchnge/vault/secrets/transit-token`, never to a terminal or a log: + `/srv/exch/vault/secrets/transit-token`, never to a terminal or a log: ```sh - vault token create -orphan -period=768h -policy=sxchnge-vault-unseal \ - -display-name=sxchnge-vault- -field=token + vault token create -orphan -period=768h -policy=exch-vault-unseal \ + -display-name=exch-vault- -field=token ``` -2. Copy `vault/` and `.local/prod/images.env` to `/srv/sxchnge/vault` on both +2. Copy `vault/` and `.local/prod/images.env` to `/srv/exch/vault` on both servers. 3. Start the nodes: on `exch` `docker compose --env-file images.env -f exch.yml up -d`, on `infra-gamma` the same with `gamma.yml`. 4. Initialize once, on `exch`: - `docker exec -it sxchnge-vault-vault-1-1 vault operator init -recovery-shares=5 -recovery-threshold=3`. + `docker exec -it exch-vault-vault-1-1 vault operator init -recovery-shares=5 -recovery-threshold=3`. The output is shown once; store the recovery keys and the root token with their holders. Revoke the root token after the bootstrap; a new one is generated with the recovery keys when needed. @@ -92,6 +92,6 @@ another server is a change of its config file and of every `retry_join` list. Running nodes keep working. To start a node without the platform Vault, start any temporary Vault, enable `transit`, load the stored key backup with -`vault write transit/restore/sxchnge-vault-unseal backup=`, issue a token +`vault write transit/restore/exch-vault-unseal backup=`, issue a token with the policy above, and point `address` in the node configs at that Vault. Without the key backup the data cannot be unsealed again. diff --git a/infra/prod/vault/config/vault-1.hcl b/infra/prod/vault/config/vault-1.hcl index 367fe96..6cdb663 100644 --- a/infra/prod/vault/config/vault-1.hcl +++ b/infra/prod/vault/config/vault-1.hcl @@ -1,4 +1,4 @@ -# SXCHNGE production Vault, node 1. Only api_addr, cluster_addr and node_id +# Production Vault, node 1. Only api_addr, cluster_addr and node_id # differ between the three node files. ui = true disable_mlock = true @@ -15,7 +15,7 @@ listener "tcp" { storage "raft" { path = "/vault/file" - node_id = "sxchnge-vault-1" + node_id = "exch-vault-1" retry_join { leader_api_addr = "http://192.168.10.191:8200" } retry_join { leader_api_addr = "http://192.168.10.191:8210" } retry_join { leader_api_addr = "http://192.168.10.98:8200" } @@ -26,5 +26,5 @@ storage "raft" { seal "transit" { address = "https://vault.sendico.io" mount_path = "transit/" - key_name = "sxchnge-vault-unseal" + key_name = "exch-vault-unseal" } diff --git a/infra/prod/vault/config/vault-2.hcl b/infra/prod/vault/config/vault-2.hcl index 6456d38..241685d 100644 --- a/infra/prod/vault/config/vault-2.hcl +++ b/infra/prod/vault/config/vault-2.hcl @@ -1,4 +1,4 @@ -# SXCHNGE production Vault, node 2. Only api_addr, cluster_addr and node_id +# Production Vault, node 2. Only api_addr, cluster_addr and node_id # differ between the three node files. ui = true disable_mlock = true @@ -15,7 +15,7 @@ listener "tcp" { storage "raft" { path = "/vault/file" - node_id = "sxchnge-vault-2" + node_id = "exch-vault-2" retry_join { leader_api_addr = "http://192.168.10.191:8200" } retry_join { leader_api_addr = "http://192.168.10.191:8210" } retry_join { leader_api_addr = "http://192.168.10.98:8200" } @@ -26,5 +26,5 @@ storage "raft" { seal "transit" { address = "https://vault.sendico.io" mount_path = "transit/" - key_name = "sxchnge-vault-unseal" + key_name = "exch-vault-unseal" } diff --git a/infra/prod/vault/config/vault-3.hcl b/infra/prod/vault/config/vault-3.hcl index f95cdab..bd44224 100644 --- a/infra/prod/vault/config/vault-3.hcl +++ b/infra/prod/vault/config/vault-3.hcl @@ -1,4 +1,4 @@ -# SXCHNGE production Vault, node 3. Only api_addr, cluster_addr and node_id +# Production Vault, node 3. Only api_addr, cluster_addr and node_id # differ between the three node files. ui = true disable_mlock = true @@ -15,7 +15,7 @@ listener "tcp" { storage "raft" { path = "/vault/file" - node_id = "sxchnge-vault-3" + node_id = "exch-vault-3" retry_join { leader_api_addr = "http://192.168.10.191:8200" } retry_join { leader_api_addr = "http://192.168.10.191:8210" } retry_join { leader_api_addr = "http://192.168.10.98:8200" } @@ -26,5 +26,5 @@ storage "raft" { seal "transit" { address = "https://vault.sendico.io" mount_path = "transit/" - key_name = "sxchnge-vault-unseal" + key_name = "exch-vault-unseal" } diff --git a/infra/prod/vault/exch.yml b/infra/prod/vault/exch.yml index 4f24159..c05266b 100644 --- a/infra/prod/vault/exch.yml +++ b/infra/prod/vault/exch.yml @@ -1,6 +1,6 @@ -# SXCHNGE production Vault on exch: nodes 1 and 2 of three (#74). Node 3 runs +# Production Vault on exch: nodes 1 and 2 of three (#74). Node 3 runs # on infra-gamma (gamma.yml). Ports are published on the private address only. -name: sxchnge-vault +name: exch-vault x-vault: &vault image: ${VAULT_IMAGE:?Run make prod-images and copy images.env} @@ -29,7 +29,7 @@ services: - ./config/vault-1.hcl:/vault/config/vault.hcl:ro - ./start.sh:/etc/vault/start.sh:ro networks: - sxchnge: + exch: aliases: [vault] vault-2: @@ -42,7 +42,7 @@ services: - ./config/vault-2.hcl:/vault/config/vault.hcl:ro - ./start.sh:/etc/vault/start.sh:ro networks: - sxchnge: + exch: aliases: [vault] secrets: @@ -55,5 +55,5 @@ volumes: # Applications on exch join this network and use http://vault:8200. networks: - sxchnge: - name: sxchnge + exch: + name: exch diff --git a/infra/prod/vault/gamma.yml b/infra/prod/vault/gamma.yml index 031e45e..09523cd 100644 --- a/infra/prod/vault/gamma.yml +++ b/infra/prod/vault/gamma.yml @@ -1,6 +1,6 @@ -# SXCHNGE production Vault on infra-gamma: node 3 of three (#74). It keeps a +# Production Vault on infra-gamma: node 3 of three (#74). It keeps a # copy of the data off exch; nodes 1 and 2 run on exch (exch.yml). -name: sxchnge-vault +name: exch-vault services: vault-3: