Name the production Vault after the exch product

The internal name of the product is exch, like its production server.
Paths, the Compose project, the Docker network, raft node ids and the
transit seal key and policy use it before the first rollout, so nothing
has to be renamed once data exists.

infra/prod/README.md

@@ -1,11 +1,11 @@
 # Production
 
 Production runs on two servers of the shared private network: `exch`
-(192.168.10.191), the SXCHNGE server, and `infra-gamma` (192.168.10.98), which
+(192.168.10.191), the production server, and `infra-gamma` (192.168.10.98), which
 keeps the third copy of the data. Each component runs two nodes on `exch` and
 one on `infra-gamma`: losing `infra-gamma` keeps the majority, losing one node on
 `exch` keeps two of three. Every server runs plain Docker Compose; files are
-deployed to `/srv/sxchnge/<component>` on the server.
+deployed to `/srv/exch/<component>` on the server.
 
 Ports are published on the private addresses only. Traffic between the servers
 is not wrapped in TLS: the network is private and limited by security groups,
@@ -17,11 +17,11 @@ and every component authenticates its peers.
 
 | Node | Server | API | Cluster | Compose |
 | --- | --- | --- | --- | --- |
-| `sxchnge-vault-1` | exch | 192.168.10.191:8200 | :8201 | `vault/exch.yml` |
+| `exch-vault-1` | exch | 192.168.10.191:8200 | :8201 | `vault/exch.yml` |
-| `sxchnge-vault-2` | exch | 192.168.10.191:8210 | :8211 | `vault/exch.yml` |
+| `exch-vault-2` | exch | 192.168.10.191:8210 | :8211 | `vault/exch.yml` |
-| `sxchnge-vault-3` | infra-gamma | 192.168.10.98:8200 | :8201 | `vault/gamma.yml` |
+| `exch-vault-3` | infra-gamma | 192.168.10.98:8200 | :8201 | `vault/gamma.yml` |
 
-Containers on `exch` join the Docker network `sxchnge` and use
+Containers on `exch` join the Docker network `exch` and use
 `http://vault:8200`; the alias belongs to both local nodes. A standby node
 forwards requests to the active one, so the leader may be on any server.
 
@@ -30,14 +30,14 @@ from an administrator's machine, for example
 `ssh -N -L 8200:192.168.10.191:8200 exch` and then `http://localhost:8200/ui`.
 
 Nodes unseal themselves with the `transit` seal on the platform Vault
-(`https://vault.sendico.io`, key `transit/keys/sxchnge-vault-unseal`). Each server
+(`https://vault.sendico.io`, key `transit/keys/exch-vault-unseal`). Each server
 has its own periodic token in `secrets/transit-token` (root, mode 600, not in Git)
 that may only encrypt and decrypt with that key. If the platform Vault is
 unreachable while a node starts, the node stays sealed until it is reachable
 again; running nodes are not affected. `vault operator init` returns recovery
 keys, not unseal keys: they authorize operations such as generating a new root
 token but cannot unseal a node. Only the transit key can. Its backup
-(`transit/backup/sxchnge-vault-unseal`), the recovery keys and the root token are
+(`transit/backup/exch-vault-unseal`), the recovery keys and the root token are
 kept outside the servers by their holders; see "Platform Vault lost".
 
 `make prod-images` resolves the latest stable Vault release and pins its digest in
@@ -51,29 +51,29 @@ time.
 
    ```sh
    vault secrets list | grep -q '^transit/' || vault secrets enable transit
-   vault write transit/keys/sxchnge-vault-unseal exportable=true allow_plaintext_backup=true
+   vault write transit/keys/exch-vault-unseal exportable=true allow_plaintext_backup=true
-   vault read -field=backup transit/backup/sxchnge-vault-unseal   # store with the holders, then clear the terminal
+   vault read -field=backup transit/backup/exch-vault-unseal   # store with the holders, then clear the terminal
-   vault policy write sxchnge-vault-unseal - <<'EOF'
+   vault policy write exch-vault-unseal - <<'EOF'
-   path "transit/encrypt/sxchnge-vault-unseal" { capabilities = ["update"] }
+   path "transit/encrypt/exch-vault-unseal" { capabilities = ["update"] }
-   path "transit/decrypt/sxchnge-vault-unseal" { capabilities = ["update"] }
+   path "transit/decrypt/exch-vault-unseal" { capabilities = ["update"] }
    EOF
    ```
 
    Create one token per server and write it straight into that server's
-   `/srv/sxchnge/vault/secrets/transit-token`, never to a terminal or a log:
+   `/srv/exch/vault/secrets/transit-token`, never to a terminal or a log:
 
    ```sh
-   vault token create -orphan -period=768h -policy=sxchnge-vault-unseal \
+   vault token create -orphan -period=768h -policy=exch-vault-unseal \
-     -display-name=sxchnge-vault-<server> -field=token
+     -display-name=exch-vault-<server> -field=token
    ```
 
-2. Copy `vault/` and `.local/prod/images.env` to `/srv/sxchnge/vault` on both
+2. Copy `vault/` and `.local/prod/images.env` to `/srv/exch/vault` on both
    servers.
 3. Start the nodes: on `exch`
    `docker compose --env-file images.env -f exch.yml up -d`, on `infra-gamma`
    the same with `gamma.yml`.
 4. Initialize once, on `exch`:
-   `docker exec -it sxchnge-vault-vault-1-1 vault operator init -recovery-shares=5 -recovery-threshold=3`.
+   `docker exec -it exch-vault-vault-1-1 vault operator init -recovery-shares=5 -recovery-threshold=3`.
    The output is shown once; store the recovery keys and the root token with
    their holders. Revoke the root token after the bootstrap; a new one is
    generated with the recovery keys when needed.
@@ -92,6 +92,6 @@ another server is a change of its config file and of every `retry_join` list.
 
 Running nodes keep working. To start a node without the platform Vault, start
 any temporary Vault, enable `transit`, load the stored key backup with
-`vault write transit/restore/sxchnge-vault-unseal backup=<backup>`, issue a token
+`vault write transit/restore/exch-vault-unseal backup=<backup>`, issue a token
 with the policy above, and point `address` in the node configs at that Vault.
 Without the key backup the data cannot be unsealed again.

infra/prod/vault/config/vault-1.hcl

@@ -1,4 +1,4 @@
-# SXCHNGE production Vault, node 1. Only api_addr, cluster_addr and node_id
+# Production Vault, node 1. Only api_addr, cluster_addr and node_id
 # differ between the three node files.
 ui            = true
 disable_mlock = true
@@ -15,7 +15,7 @@ listener "tcp" {
 
 storage "raft" {
   path    = "/vault/file"
-  node_id = "sxchnge-vault-1"
+  node_id = "exch-vault-1"
   retry_join { leader_api_addr = "http://192.168.10.191:8200" }
   retry_join { leader_api_addr = "http://192.168.10.191:8210" }
   retry_join { leader_api_addr = "http://192.168.10.98:8200" }
@@ -26,5 +26,5 @@ storage "raft" {
 seal "transit" {
   address    = "https://vault.sendico.io"
   mount_path = "transit/"
-  key_name   = "sxchnge-vault-unseal"
+  key_name   = "exch-vault-unseal"
 }

infra/prod/vault/config/vault-2.hcl

@@ -1,4 +1,4 @@
-# SXCHNGE production Vault, node 2. Only api_addr, cluster_addr and node_id
+# Production Vault, node 2. Only api_addr, cluster_addr and node_id
 # differ between the three node files.
 ui            = true
 disable_mlock = true
@@ -15,7 +15,7 @@ listener "tcp" {
 
 storage "raft" {
   path    = "/vault/file"
-  node_id = "sxchnge-vault-2"
+  node_id = "exch-vault-2"
   retry_join { leader_api_addr = "http://192.168.10.191:8200" }
   retry_join { leader_api_addr = "http://192.168.10.191:8210" }
   retry_join { leader_api_addr = "http://192.168.10.98:8200" }
@@ -26,5 +26,5 @@ storage "raft" {
 seal "transit" {
   address    = "https://vault.sendico.io"
   mount_path = "transit/"
-  key_name   = "sxchnge-vault-unseal"
+  key_name   = "exch-vault-unseal"
 }

infra/prod/vault/config/vault-3.hcl

@@ -1,4 +1,4 @@
-# SXCHNGE production Vault, node 3. Only api_addr, cluster_addr and node_id
+# Production Vault, node 3. Only api_addr, cluster_addr and node_id
 # differ between the three node files.
 ui            = true
 disable_mlock = true
@@ -15,7 +15,7 @@ listener "tcp" {
 
 storage "raft" {
   path    = "/vault/file"
-  node_id = "sxchnge-vault-3"
+  node_id = "exch-vault-3"
   retry_join { leader_api_addr = "http://192.168.10.191:8200" }
   retry_join { leader_api_addr = "http://192.168.10.191:8210" }
   retry_join { leader_api_addr = "http://192.168.10.98:8200" }
@@ -26,5 +26,5 @@ storage "raft" {
 seal "transit" {
   address    = "https://vault.sendico.io"
   mount_path = "transit/"
-  key_name   = "sxchnge-vault-unseal"
+  key_name   = "exch-vault-unseal"
 }

infra/prod/vault/exch.yml

@@ -1,6 +1,6 @@
-# SXCHNGE production Vault on exch: nodes 1 and 2 of three (#74). Node 3 runs
+# Production Vault on exch: nodes 1 and 2 of three (#74). Node 3 runs
 # on infra-gamma (gamma.yml). Ports are published on the private address only.
-name: sxchnge-vault
+name: exch-vault
 
 x-vault: &vault
   image: ${VAULT_IMAGE:?Run make prod-images and copy images.env}
@@ -29,7 +29,7 @@ services:
       - ./config/vault-1.hcl:/vault/config/vault.hcl:ro
       - ./start.sh:/etc/vault/start.sh:ro
     networks:
-      sxchnge:
+      exch:
         aliases: [vault]
 
   vault-2:
@@ -42,7 +42,7 @@ services:
       - ./config/vault-2.hcl:/vault/config/vault.hcl:ro
       - ./start.sh:/etc/vault/start.sh:ro
     networks:
-      sxchnge:
+      exch:
         aliases: [vault]
 
 secrets:
@@ -55,5 +55,5 @@ volumes:
 
 # Applications on exch join this network and use http://vault:8200.
 networks:
-  sxchnge:
+  exch:
-    name: sxchnge
+    name: exch

infra/prod/vault/gamma.yml

@@ -1,6 +1,6 @@
-# SXCHNGE production Vault on infra-gamma: node 3 of three (#74). It keeps a
+# Production Vault on infra-gamma: node 3 of three (#74). It keeps a
 # copy of the data off exch; nodes 1 and 2 run on exch (exch.yml).
-name: sxchnge-vault
+name: exch-vault
 
 services:
   vault-3: