Run the production Vault as three raft nodes on exch and infra-gamma
Two nodes on exch and one on infra-gamma, plain Compose per server, ports on the private addresses only. Nodes unseal through the transit seal on the platform Vault; the transit token reaches only the server process. make prod-images resolves the latest stable Vault release once and pins its digest in ignored .local/prod/images.env, so every node runs the same build. infra/prod/README.md records the layout, the first rollout, node replacement and recovery when the platform Vault is lost (#74).
This commit is contained in:
protuberanets committed
1 parent
3b551f1565
commit
f436b2528c
11 files changed
+299
-1
No files matched your search
@@ -0,0 +1,30 @@
|
||||
# SXCHNGE production Vault, node 1. Only api_addr, cluster_addr and node_id
|
||||
# differ between the three node files.
|
||||
ui = false
|
||||
disable_mlock = false
|
||||
api_addr = "http://192.168.10.191:8200"
|
||||
cluster_addr = "https://192.168.10.191:8201"
|
||||
|
||||
listener "tcp" {
|
||||
address = "0.0.0.0:8200"
|
||||
cluster_address = "0.0.0.0:8201"
|
||||
# Plain HTTP on the private network; raft and request forwarding on the
|
||||
# cluster port are encrypted by Vault itself.
|
||||
tls_disable = true
|
||||
}
|
||||
|
||||
storage "raft" {
|
||||
path = "/vault/file"
|
||||
node_id = "sxchnge-vault-1"
|
||||
retry_join { leader_api_addr = "http://192.168.10.191:8200" }
|
||||
retry_join { leader_api_addr = "http://192.168.10.191:8210" }
|
||||
retry_join { leader_api_addr = "http://192.168.10.98:8200" }
|
||||
}
|
||||
|
||||
# Auto-unseal with the platform Vault. The token comes from VAULT_TOKEN, set by
|
||||
# start.sh from the secret file; recovery keys stay with people.
|
||||
seal "transit" {
|
||||
address = "https://vault.sendico.io"
|
||||
mount_path = "transit/"
|
||||
key_name = "sxchnge-vault-unseal"
|
||||
}
|
||||
@@ -0,0 +1,30 @@
|
||||
# SXCHNGE production Vault, node 2. Only api_addr, cluster_addr and node_id
|
||||
# differ between the three node files.
|
||||
ui = false
|
||||
disable_mlock = false
|
||||
api_addr = "http://192.168.10.191:8210"
|
||||
cluster_addr = "https://192.168.10.191:8211"
|
||||
|
||||
listener "tcp" {
|
||||
address = "0.0.0.0:8200"
|
||||
cluster_address = "0.0.0.0:8201"
|
||||
# Plain HTTP on the private network; raft and request forwarding on the
|
||||
# cluster port are encrypted by Vault itself.
|
||||
tls_disable = true
|
||||
}
|
||||
|
||||
storage "raft" {
|
||||
path = "/vault/file"
|
||||
node_id = "sxchnge-vault-2"
|
||||
retry_join { leader_api_addr = "http://192.168.10.191:8200" }
|
||||
retry_join { leader_api_addr = "http://192.168.10.191:8210" }
|
||||
retry_join { leader_api_addr = "http://192.168.10.98:8200" }
|
||||
}
|
||||
|
||||
# Auto-unseal with the platform Vault. The token comes from VAULT_TOKEN, set by
|
||||
# start.sh from the secret file; recovery keys stay with people.
|
||||
seal "transit" {
|
||||
address = "https://vault.sendico.io"
|
||||
mount_path = "transit/"
|
||||
key_name = "sxchnge-vault-unseal"
|
||||
}
|
||||
@@ -0,0 +1,30 @@
|
||||
# SXCHNGE production Vault, node 3. Only api_addr, cluster_addr and node_id
|
||||
# differ between the three node files.
|
||||
ui = false
|
||||
disable_mlock = false
|
||||
api_addr = "http://192.168.10.98:8200"
|
||||
cluster_addr = "https://192.168.10.98:8201"
|
||||
|
||||
listener "tcp" {
|
||||
address = "0.0.0.0:8200"
|
||||
cluster_address = "0.0.0.0:8201"
|
||||
# Plain HTTP on the private network; raft and request forwarding on the
|
||||
# cluster port are encrypted by Vault itself.
|
||||
tls_disable = true
|
||||
}
|
||||
|
||||
storage "raft" {
|
||||
path = "/vault/file"
|
||||
node_id = "sxchnge-vault-3"
|
||||
retry_join { leader_api_addr = "http://192.168.10.191:8200" }
|
||||
retry_join { leader_api_addr = "http://192.168.10.191:8210" }
|
||||
retry_join { leader_api_addr = "http://192.168.10.98:8200" }
|
||||
}
|
||||
|
||||
# Auto-unseal with the platform Vault. The token comes from VAULT_TOKEN, set by
|
||||
# start.sh from the secret file; recovery keys stay with people.
|
||||
seal "transit" {
|
||||
address = "https://vault.sendico.io"
|
||||
mount_path = "transit/"
|
||||
key_name = "sxchnge-vault-unseal"
|
||||
}
|
||||
@@ -0,0 +1,59 @@
|
||||
# SXCHNGE production Vault on exch: nodes 1 and 2 of three (#74). Node 3 runs
|
||||
# on infra-gamma (gamma.yml). Ports are published on the private address only.
|
||||
name: sxchnge-vault
|
||||
|
||||
x-vault: &vault
|
||||
image: ${VAULT_IMAGE:?Run make prod-images and copy images.env}
|
||||
restart: unless-stopped
|
||||
cap_add: [IPC_LOCK]
|
||||
ulimits: {memlock: {soft: -1, hard: -1}}
|
||||
environment:
|
||||
VAULT_ADDR: http://127.0.0.1:8200
|
||||
SKIP_SETCAP: 'true'
|
||||
entrypoint: [/bin/sh, /etc/vault/start.sh]
|
||||
secrets: [transit-token]
|
||||
healthcheck:
|
||||
test: [CMD-SHELL, 'vault status >/dev/null']
|
||||
interval: 10s
|
||||
timeout: 5s
|
||||
retries: 6
|
||||
|
||||
services:
|
||||
vault-1:
|
||||
<<: *vault
|
||||
ports:
|
||||
- 192.168.10.191:8200:8200
|
||||
- 192.168.10.191:8201:8201
|
||||
volumes:
|
||||
- vault-1-data:/vault/file
|
||||
- ./config/vault-1.hcl:/vault/config/vault.hcl:ro
|
||||
- ./start.sh:/etc/vault/start.sh:ro
|
||||
networks:
|
||||
sxchnge:
|
||||
aliases: [vault]
|
||||
|
||||
vault-2:
|
||||
<<: *vault
|
||||
ports:
|
||||
- 192.168.10.191:8210:8200
|
||||
- 192.168.10.191:8211:8201
|
||||
volumes:
|
||||
- vault-2-data:/vault/file
|
||||
- ./config/vault-2.hcl:/vault/config/vault.hcl:ro
|
||||
- ./start.sh:/etc/vault/start.sh:ro
|
||||
networks:
|
||||
sxchnge:
|
||||
aliases: [vault]
|
||||
|
||||
secrets:
|
||||
transit-token:
|
||||
file: ./secrets/transit-token
|
||||
|
||||
volumes:
|
||||
vault-1-data:
|
||||
vault-2-data:
|
||||
|
||||
# Applications on exch join this network and use http://vault:8200.
|
||||
networks:
|
||||
sxchnge:
|
||||
name: sxchnge
|
||||
@@ -0,0 +1,34 @@
|
||||
# SXCHNGE production Vault on infra-gamma: node 3 of three (#74). It keeps a
|
||||
# copy of the data off exch; nodes 1 and 2 run on exch (exch.yml).
|
||||
name: sxchnge-vault
|
||||
|
||||
services:
|
||||
vault-3:
|
||||
image: ${VAULT_IMAGE:?Run make prod-images and copy images.env}
|
||||
restart: unless-stopped
|
||||
cap_add: [IPC_LOCK]
|
||||
ulimits: {memlock: {soft: -1, hard: -1}}
|
||||
environment:
|
||||
VAULT_ADDR: http://127.0.0.1:8200
|
||||
SKIP_SETCAP: 'true'
|
||||
entrypoint: [/bin/sh, /etc/vault/start.sh]
|
||||
secrets: [transit-token]
|
||||
healthcheck:
|
||||
test: [CMD-SHELL, 'vault status >/dev/null']
|
||||
interval: 10s
|
||||
timeout: 5s
|
||||
retries: 6
|
||||
ports:
|
||||
- 192.168.10.98:8200:8200
|
||||
- 192.168.10.98:8201:8201
|
||||
volumes:
|
||||
- vault-3-data:/vault/file
|
||||
- ./config/vault-3.hcl:/vault/config/vault.hcl:ro
|
||||
- ./start.sh:/etc/vault/start.sh:ro
|
||||
|
||||
secrets:
|
||||
transit-token:
|
||||
file: ./secrets/transit-token
|
||||
|
||||
volumes:
|
||||
vault-3-data:
|
||||
@@ -0,0 +1,8 @@
|
||||
#!/bin/sh
|
||||
# Hands the transit seal token to the Vault server process only: it is read
|
||||
# from the secret file here, so it is not part of the container environment.
|
||||
set -eu
|
||||
VAULT_TOKEN=$(cat /run/secrets/transit-token)
|
||||
[ -n "$VAULT_TOKEN" ] || { echo 'Empty transit seal token' >&2; exit 1; }
|
||||
export VAULT_TOKEN
|
||||
exec docker-entrypoint.sh vault server -config=/vault/config/vault.hcl
|
||||
Reference in new issue
Block a user