protuberanets
2f74d3627e
The UI stays reachable on the private addresses only. Integrated raft storage runs with mlock disabled, as on the platform Vault and as Vault recommends for raft.
31 lines
1020 B
HCL
31 lines
1020 B
HCL
# SXCHNGE production Vault, node 2. Only api_addr, cluster_addr and node_id
|
|
# differ between the three node files.
|
|
ui = true
|
|
disable_mlock = true
|
|
api_addr = "http://192.168.10.191:8210"
|
|
cluster_addr = "https://192.168.10.191:8211"
|
|
|
|
listener "tcp" {
|
|
address = "0.0.0.0:8200"
|
|
cluster_address = "0.0.0.0:8201"
|
|
# Plain HTTP on the private network; raft and request forwarding on the
|
|
# cluster port are encrypted by Vault itself.
|
|
tls_disable = 1
|
|
}
|
|
|
|
storage "raft" {
|
|
path = "/vault/file"
|
|
node_id = "sxchnge-vault-2"
|
|
retry_join { leader_api_addr = "http://192.168.10.191:8200" }
|
|
retry_join { leader_api_addr = "http://192.168.10.191:8210" }
|
|
retry_join { leader_api_addr = "http://192.168.10.98:8200" }
|
|
}
|
|
|
|
# Auto-unseal with the platform Vault. The token comes from VAULT_TOKEN, set by
|
|
# start.sh from the secret file; recovery keys stay with people.
|
|
seal "transit" {
|
|
address = "https://vault.sendico.io"
|
|
mount_path = "transit/"
|
|
key_name = "sxchnge-vault-unseal"
|
|
}
|