protuberanets
f436b2528c
Two nodes on exch and one on infra-gamma, plain Compose per server, ports on the private addresses only. Nodes unseal through the transit seal on the platform Vault; the transit token reaches only the server process. make prod-images resolves the latest stable Vault release once and pins its digest in ignored .local/prod/images.env, so every node runs the same build. infra/prod/README.md records the layout, the first rollout, node replacement and recovery when the platform Vault is lost (#74).
60 lines
1.4 KiB
YAML
60 lines
1.4 KiB
YAML
# SXCHNGE production Vault on exch: nodes 1 and 2 of three (#74). Node 3 runs
|
|
# on infra-gamma (gamma.yml). Ports are published on the private address only.
|
|
name: sxchnge-vault
|
|
|
|
x-vault: &vault
|
|
image: ${VAULT_IMAGE:?Run make prod-images and copy images.env}
|
|
restart: unless-stopped
|
|
cap_add: [IPC_LOCK]
|
|
ulimits: {memlock: {soft: -1, hard: -1}}
|
|
environment:
|
|
VAULT_ADDR: http://127.0.0.1:8200
|
|
SKIP_SETCAP: 'true'
|
|
entrypoint: [/bin/sh, /etc/vault/start.sh]
|
|
secrets: [transit-token]
|
|
healthcheck:
|
|
test: [CMD-SHELL, 'vault status >/dev/null']
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 6
|
|
|
|
services:
|
|
vault-1:
|
|
<<: *vault
|
|
ports:
|
|
- 192.168.10.191:8200:8200
|
|
- 192.168.10.191:8201:8201
|
|
volumes:
|
|
- vault-1-data:/vault/file
|
|
- ./config/vault-1.hcl:/vault/config/vault.hcl:ro
|
|
- ./start.sh:/etc/vault/start.sh:ro
|
|
networks:
|
|
sxchnge:
|
|
aliases: [vault]
|
|
|
|
vault-2:
|
|
<<: *vault
|
|
ports:
|
|
- 192.168.10.191:8210:8200
|
|
- 192.168.10.191:8211:8201
|
|
volumes:
|
|
- vault-2-data:/vault/file
|
|
- ./config/vault-2.hcl:/vault/config/vault.hcl:ro
|
|
- ./start.sh:/etc/vault/start.sh:ro
|
|
networks:
|
|
sxchnge:
|
|
aliases: [vault]
|
|
|
|
secrets:
|
|
transit-token:
|
|
file: ./secrets/transit-token
|
|
|
|
volumes:
|
|
vault-1-data:
|
|
vault-2-data:
|
|
|
|
# Applications on exch join this network and use http://vault:8200.
|
|
networks:
|
|
sxchnge:
|
|
name: sxchnge
|