# Production Vault on infra-gamma: node 3 of three (#74). It keeps a
# copy of the data off exch; nodes 1 and 2 run on exch (exch.yml).
name: exch-vault

services:
  vault-3:
    image: ${VAULT_IMAGE:?Run make prod-images and copy images.env}
    restart: unless-stopped
    cap_add: [IPC_LOCK]
    ulimits: {memlock: {soft: -1, hard: -1}}
    environment:
      VAULT_ADDR: http://127.0.0.1:8200
      SKIP_SETCAP: 'true'
    entrypoint: [/bin/sh, /etc/vault/start.sh]
    secrets: [transit-token]
    healthcheck:
      test: [CMD-SHELL, 'vault status >/dev/null']
      interval: 10s
      timeout: 5s
      retries: 6
    ports:
      - 192.168.10.98:8200:8200
      - 192.168.10.98:8201:8201
    volumes:
      - vault-3-data:/vault/file
      - ./config/vault-3.hcl:/vault/config/vault.hcl:ro
      - ./start.sh:/etc/vault/start.sh:ro

secrets:
  transit-token:
    file: ./secrets/transit-token

volumes:
  vault-3-data: