protuberanets
f436b2528c
Two nodes on exch and one on infra-gamma, plain Compose per server, ports on the private addresses only. Nodes unseal through the transit seal on the platform Vault; the transit token reaches only the server process. make prod-images resolves the latest stable Vault release once and pins its digest in ignored .local/prod/images.env, so every node runs the same build. infra/prod/README.md records the layout, the first rollout, node replacement and recovery when the platform Vault is lost (#74).
9 lines
381 B
Bash
9 lines
381 B
Bash
#!/bin/sh
|
|
# Hands the transit seal token to the Vault server process only: it is read
|
|
# from the secret file here, so it is not part of the container environment.
|
|
set -eu
|
|
VAULT_TOKEN=$(cat /run/secrets/transit-token)
|
|
[ -n "$VAULT_TOKEN" ] || { echo 'Empty transit seal token' >&2; exit 1; }
|
|
export VAULT_TOKEN
|
|
exec docker-entrypoint.sh vault server -config=/vault/config/vault.hcl
|