protuberanets
4cdf71b7f8
The internal name of the product is exch, like its production server. Paths, the Compose project, the Docker network, raft node ids and the transit seal key and policy use it before the first rollout, so nothing has to be renamed once data exists.
31 lines
1006 B
HCL
31 lines
1006 B
HCL
# Production Vault, node 2. Only api_addr, cluster_addr and node_id
|
|
# differ between the three node files.
|
|
ui = true
|
|
disable_mlock = true
|
|
api_addr = "http://192.168.10.191:8210"
|
|
cluster_addr = "https://192.168.10.191:8211"
|
|
|
|
listener "tcp" {
|
|
address = "0.0.0.0:8200"
|
|
cluster_address = "0.0.0.0:8201"
|
|
# Plain HTTP on the private network; raft and request forwarding on the
|
|
# cluster port are encrypted by Vault itself.
|
|
tls_disable = 1
|
|
}
|
|
|
|
storage "raft" {
|
|
path = "/vault/file"
|
|
node_id = "exch-vault-2"
|
|
retry_join { leader_api_addr = "http://192.168.10.191:8200" }
|
|
retry_join { leader_api_addr = "http://192.168.10.191:8210" }
|
|
retry_join { leader_api_addr = "http://192.168.10.98:8200" }
|
|
}
|
|
|
|
# Auto-unseal with the platform Vault. The token comes from VAULT_TOKEN, set by
|
|
# start.sh from the secret file; recovery keys stay with people.
|
|
seal "transit" {
|
|
address = "https://vault.sendico.io"
|
|
mount_path = "transit/"
|
|
key_name = "exch-vault-unseal"
|
|
}
|