# SXCHNGE production Vault, node 3. Only api_addr, cluster_addr and node_id
# differ between the three node files.
ui            = true
disable_mlock = true
api_addr      = "http://192.168.10.98:8200"
cluster_addr  = "https://192.168.10.98:8201"

listener "tcp" {
  address         = "0.0.0.0:8200"
  cluster_address = "0.0.0.0:8201"
  # Plain HTTP on the private network; raft and request forwarding on the
  # cluster port are encrypted by Vault itself.
  tls_disable     = 1
}

storage "raft" {
  path    = "/vault/file"
  node_id = "sxchnge-vault-3"
  retry_join { leader_api_addr = "http://192.168.10.191:8200" }
  retry_join { leader_api_addr = "http://192.168.10.191:8210" }
  retry_join { leader_api_addr = "http://192.168.10.98:8200" }
}

# Auto-unseal with the platform Vault. The token comes from VAULT_TOKEN, set by
# start.sh from the secret file; recovery keys stay with people.
seal "transit" {
  address    = "https://vault.sendico.io"
  mount_path = "transit/"
  key_name   = "sxchnge-vault-unseal"
}