protuberanets
4cdf71b7f8
The internal name of the product is exch, like its production server. Paths, the Compose project, the Docker network, raft node ids and the transit seal key and policy use it before the first rollout, so nothing has to be renamed once data exists.
60 lines
1.4 KiB
YAML
60 lines
1.4 KiB
YAML
# Production Vault on exch: nodes 1 and 2 of three (#74). Node 3 runs
|
|
# on infra-gamma (gamma.yml). Ports are published on the private address only.
|
|
name: exch-vault
|
|
|
|
x-vault: &vault
|
|
image: ${VAULT_IMAGE:?Run make prod-images and copy images.env}
|
|
restart: unless-stopped
|
|
cap_add: [IPC_LOCK]
|
|
ulimits: {memlock: {soft: -1, hard: -1}}
|
|
environment:
|
|
VAULT_ADDR: http://127.0.0.1:8200
|
|
SKIP_SETCAP: 'true'
|
|
entrypoint: [/bin/sh, /etc/vault/start.sh]
|
|
secrets: [transit-token]
|
|
healthcheck:
|
|
test: [CMD-SHELL, 'vault status >/dev/null']
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 6
|
|
|
|
services:
|
|
vault-1:
|
|
<<: *vault
|
|
ports:
|
|
- 192.168.10.191:8200:8200
|
|
- 192.168.10.191:8201:8201
|
|
volumes:
|
|
- vault-1-data:/vault/file
|
|
- ./config/vault-1.hcl:/vault/config/vault.hcl:ro
|
|
- ./start.sh:/etc/vault/start.sh:ro
|
|
networks:
|
|
exch:
|
|
aliases: [vault]
|
|
|
|
vault-2:
|
|
<<: *vault
|
|
ports:
|
|
- 192.168.10.191:8210:8200
|
|
- 192.168.10.191:8211:8201
|
|
volumes:
|
|
- vault-2-data:/vault/file
|
|
- ./config/vault-2.hcl:/vault/config/vault.hcl:ro
|
|
- ./start.sh:/etc/vault/start.sh:ro
|
|
networks:
|
|
exch:
|
|
aliases: [vault]
|
|
|
|
secrets:
|
|
transit-token:
|
|
file: ./secrets/transit-token
|
|
|
|
volumes:
|
|
vault-1-data:
|
|
vault-2-data:
|
|
|
|
# Applications on exch join this network and use http://vault:8200.
|
|
networks:
|
|
exch:
|
|
name: exch
|