# SXCHNGE production Vault on exch: nodes 1 and 2 of three (#74). Node 3 runs
# on infra-gamma (gamma.yml). Ports are published on the private address only.
name: sxchnge-vault

x-vault: &vault
  image: ${VAULT_IMAGE:?Run make prod-images and copy images.env}
  restart: unless-stopped
  cap_add: [IPC_LOCK]
  ulimits: {memlock: {soft: -1, hard: -1}}
  environment:
    VAULT_ADDR: http://127.0.0.1:8200
    SKIP_SETCAP: 'true'
  entrypoint: [/bin/sh, /etc/vault/start.sh]
  secrets: [transit-token]
  healthcheck:
    test: [CMD-SHELL, 'vault status >/dev/null']
    interval: 10s
    timeout: 5s
    retries: 6

services:
  vault-1:
    <<: *vault
    ports:
      - 192.168.10.191:8200:8200
      - 192.168.10.191:8201:8201
    volumes:
      - vault-1-data:/vault/file
      - ./config/vault-1.hcl:/vault/config/vault.hcl:ro
      - ./start.sh:/etc/vault/start.sh:ro
    networks:
      sxchnge:
        aliases: [vault]

  vault-2:
    <<: *vault
    ports:
      - 192.168.10.191:8210:8200
      - 192.168.10.191:8211:8201
    volumes:
      - vault-2-data:/vault/file
      - ./config/vault-2.hcl:/vault/config/vault.hcl:ro
      - ./start.sh:/etc/vault/start.sh:ro
    networks:
      sxchnge:
        aliases: [vault]

secrets:
  transit-token:
    file: ./secrets/transit-token

volumes:
  vault-1-data:
  vault-2-data:

# Applications on exch join this network and use http://vault:8200.
networks:
  sxchnge:
    name: sxchnge