protuberanets
4cdf71b7f8
The internal name of the product is exch, like its production server. Paths, the Compose project, the Docker network, raft node ids and the transit seal key and policy use it before the first rollout, so nothing has to be renamed once data exists.
35 lines
928 B
YAML
35 lines
928 B
YAML
# Production Vault on infra-gamma: node 3 of three (#74). It keeps a
|
|
# copy of the data off exch; nodes 1 and 2 run on exch (exch.yml).
|
|
name: exch-vault
|
|
|
|
services:
|
|
vault-3:
|
|
image: ${VAULT_IMAGE:?Run make prod-images and copy images.env}
|
|
restart: unless-stopped
|
|
cap_add: [IPC_LOCK]
|
|
ulimits: {memlock: {soft: -1, hard: -1}}
|
|
environment:
|
|
VAULT_ADDR: http://127.0.0.1:8200
|
|
SKIP_SETCAP: 'true'
|
|
entrypoint: [/bin/sh, /etc/vault/start.sh]
|
|
secrets: [transit-token]
|
|
healthcheck:
|
|
test: [CMD-SHELL, 'vault status >/dev/null']
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 6
|
|
ports:
|
|
- 192.168.10.98:8200:8200
|
|
- 192.168.10.98:8201:8201
|
|
volumes:
|
|
- vault-3-data:/vault/file
|
|
- ./config/vault-3.hcl:/vault/config/vault.hcl:ro
|
|
- ./start.sh:/etc/vault/start.sh:ro
|
|
|
|
secrets:
|
|
transit-token:
|
|
file: ./secrets/transit-token
|
|
|
|
volumes:
|
|
vault-3-data:
|