#!/bin/sh
# Hands the transit seal token to the Vault server process only: it is read
# from the secret file here, so it is not part of the container environment.
set -eu
VAULT_TOKEN=$(cat /run/secrets/transit-token)
[ -n "$VAULT_TOKEN" ] || { echo 'Empty transit seal token' >&2; exit 1; }
export VAULT_TOKEN
exec docker-entrypoint.sh vault server -config=/vault/config/vault.hcl