tech/sxchnge
1
0 Fork 0
Code Issues 6 Pull Requests 1 Actions Packages Projects 1 Releases Wiki Activity

Run the production Vault as three raft nodes on exch and infra-gamma #75

Open
protuberanets wants to merge 3 commits from prod-vault-74 into main
pull from: prod-vault-74
merge into: tech:main
Conversation 0 Commits 3 Files Changed 11
+4
1 changed files with 4 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit 1b9a89d9c4 - Show all commits
infra/prod/README.md
+4
View File
@@ -25,6 +25,10 @@ Containers on `exch` join the Docker network `sxchnge` and use
`http://vault:8200`; the alias belongs to both local nodes. A standby node `http://vault:8200`; the alias belongs to both local nodes. A standby node
forwards requests to the active one, so the leader may be on any server. forwards requests to the active one, so the leader may be on any server.
Vault is not published to the internet. Its UI is opened through an SSH tunnel
from an administrator's machine, for example
`ssh -N -L 8200:192.168.10.191:8200 exch` and then `http://localhost:8200/ui`.
Nodes unseal themselves with the `transit` seal on the platform Vault Nodes unseal themselves with the `transit` seal on the platform Vault
(`https://vault.sendico.io`, key `transit/keys/sxchnge-vault-unseal`). Each server (`https://vault.sendico.io`, key `transit/keys/sxchnge-vault-unseal`). Each server
has its own periodic token in `secrets/transit-token` (root, mode 600, not in Git) has its own periodic token in `secrets/transit-token` (root, mode 600, not in Git)