Run the production Vault as three raft nodes on exch and infra-gamma #75

2026-10-29T17:00:46Z

protuberanets commented

2026-10-29 17:00:46 +00:00

Part of #74: the first production component of SXCHNGE.

What changes

infra/prod/vault/: Compose files for exch (nodes 1 and 2) and infra-gamma (node 3), one config per node (raft, retry_join to all three), and start.sh, which passes the transit seal token from a secret file to the Vault server process only.
Ports are published on the private addresses only: exch 8200/8201 and 8210/8211, infra-gamma 8200/8201. Applications on exch use http://vault:8200 on the Docker network sxchnge.
Nodes unseal themselves through the transit seal on the platform Vault (key sxchnge-vault-unseal, created exportable so its backup can be kept by the holders).
make prod-images reuses the local resolver: latest stable hashicorp/vault, pinned by digest in ignored .local/prod/images.env, one file for all nodes. Today it resolves 2.2.1@sha256:962a9287….
infra/prod/README.md: layout, first rollout, node replacement, recovery when the platform Vault is lost.
infra/local/scripts/test.sh: shellcheck also covers infra/prod/vault/start.sh.

Validation

docker compose -f exch.yml config and -f gamma.yml config: pass.
The repository's shellcheck commands (-x -S warning) on the changed scripts: pass.
make prod-images: resolved and wrote the pin.
git diff --check: clean.
Not run yet: the live rollout. It follows infra/prod/README.md on the servers and is reported in #74; merge after it.

Out of scope

KV, AppRole and policies, the Mongo database plugin, Mongo and NATS clusters, CI deployment, raft snapshots, monitoring.

Part of #74: the first production component of SXCHNGE. ### What changes - `infra/prod/vault/`: Compose files for `exch` (nodes 1 and 2) and `infra-gamma` (node 3), one config per node (raft, `retry_join` to all three), and `start.sh`, which passes the transit seal token from a secret file to the Vault server process only. - Ports are published on the private addresses only: exch 8200/8201 and 8210/8211, infra-gamma 8200/8201. Applications on `exch` use `http://vault:8200` on the Docker network `sxchnge`. - Nodes unseal themselves through the `transit` seal on the platform Vault (key `sxchnge-vault-unseal`, created exportable so its backup can be kept by the holders). - `make prod-images` reuses the local resolver: latest stable `hashicorp/vault`, pinned by digest in ignored `.local/prod/images.env`, one file for all nodes. Today it resolves `2.2.1@sha256:962a9287…`. - `infra/prod/README.md`: layout, first rollout, node replacement, recovery when the platform Vault is lost. - `infra/local/scripts/test.sh`: shellcheck also covers `infra/prod/vault/start.sh`. ### Validation - `docker compose -f exch.yml config` and `-f gamma.yml config`: pass. - The repository's shellcheck commands (`-x -S warning`) on the changed scripts: pass. - `make prod-images`: resolved and wrote the pin. - `git diff --check`: clean. - Not run yet: the live rollout. It follows `infra/prod/README.md` on the servers and is reported in #74; merge after it. ### Out of scope KV, AppRole and policies, the Mongo database plugin, Mongo and NATS clusters, CI deployment, raft snapshots, monitoring.

protuberanets added the backend label 2026-10-29 17:00:46 +00:00

protuberanets self-assigned this 2026-10-29 17:00:46 +00:00

protuberanets added 1 commit 2026-10-29 17:00:46 +00:00

Run the production Vault as three raft nodes on exch and infra-gamma f436b2528c

Two nodes on exch and one on infra-gamma, plain Compose per server, ports
on the private addresses only. Nodes unseal through the transit seal on the
platform Vault; the transit token reaches only the server process.

make prod-images resolves the latest stable Vault release once and pins its
digest in ignored .local/prod/images.env, so every node runs the same build.

infra/prod/README.md records the layout, the first rollout, node
replacement and recovery when the platform Vault is lost (#74).

protuberanets added 1 commit 2026-10-29 17:07:24 +00:00

Match the platform Vault on UI, mlock and the TLS flag 2f74d3627e

The UI stays reachable on the private addresses only. Integrated raft storage runs with mlock disabled, as on the platform Vault and as Vault recommends for raft.

protuberanets added 1 commit 2026-10-29 18:08:01 +00:00

Keep the production Vault private and reach its UI through SSH 1b9a89d9c4

You are not authorized to merge this pull request.

This pull request can be merged automatically.

This branch is out-of-date with the base branch

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin prod-vault-74:prod-vault-74

git checkout prod-vault-74

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: tech/sxchnge#75