Organize local infrastructure and Vault secrets by service ownership

infra/local/vault/start.sh

@@ -0,0 +1,16 @@
+#!/bin/sh
+# Local-only automatic unseal. The root token is never mounted in this container.
+set -eu
+export VAULT_ADDR=http://127.0.0.1:8200
+vault server -config=/etc/vault/server.hcl &
+pid=$!
+trap 'kill -TERM "$pid"; wait "$pid"' TERM INT
+until [ -s /bootstrap/unseal ]; do
+    kill -0 "$pid" || exit 1
+    sleep 1
+done
+until vault operator unseal "$(cat /bootstrap/unseal)" >/dev/null 2>&1; do
+    kill -0 "$pid" || exit 1
+    sleep 1
+done
+wait "$pid"