Organize local infrastructure and Vault secrets by service ownership

infra/local/vault/nats.hcl

@@ -0,0 +1,25 @@
+vault { address = "http://vault:8200" }
+auto_auth {
+  method "approle" {
+    config = {
+      role_id_file_path = "/etc/agent/role-id"
+      secret_id_file_path = "/etc/agent/secret-id"
+      remove_secret_id_file_after_reading = false
+    }
+  }
+}
+template_config {
+  static_secret_render_interval = "10s"
+  exit_on_retry_failure = true
+}
+
+env_template "NATS_TOKEN" {
+  contents = "{{ with secret \"kv/data/infrastructure/nats/auth\" }}{{ .Data.data.token }}{{ end }}"
+  error_on_missing_key = true
+}
+
+exec {
+  command = ["/usr/local/bin/start-nats"]
+  restart_on_secret_changes = "always"
+  restart_stop_signal = "SIGTERM"
+}