protuberanets
f436b2528c
Two nodes on exch and one on infra-gamma, plain Compose per server, ports on the private addresses only. Nodes unseal through the transit seal on the platform Vault; the transit token reaches only the server process. make prod-images resolves the latest stable Vault release once and pins its digest in ignored .local/prod/images.env, so every node runs the same build. infra/prod/README.md records the layout, the first rollout, node replacement and recovery when the platform Vault is lost (#74).
31 lines
1019 B
HCL
31 lines
1019 B
HCL
# SXCHNGE production Vault, node 3. Only api_addr, cluster_addr and node_id
|
|
# differ between the three node files.
|
|
ui = false
|
|
disable_mlock = false
|
|
api_addr = "http://192.168.10.98:8200"
|
|
cluster_addr = "https://192.168.10.98:8201"
|
|
|
|
listener "tcp" {
|
|
address = "0.0.0.0:8200"
|
|
cluster_address = "0.0.0.0:8201"
|
|
# Plain HTTP on the private network; raft and request forwarding on the
|
|
# cluster port are encrypted by Vault itself.
|
|
tls_disable = true
|
|
}
|
|
|
|
storage "raft" {
|
|
path = "/vault/file"
|
|
node_id = "sxchnge-vault-3"
|
|
retry_join { leader_api_addr = "http://192.168.10.191:8200" }
|
|
retry_join { leader_api_addr = "http://192.168.10.191:8210" }
|
|
retry_join { leader_api_addr = "http://192.168.10.98:8200" }
|
|
}
|
|
|
|
# Auto-unseal with the platform Vault. The token comes from VAULT_TOKEN, set by
|
|
# start.sh from the secret file; recovery keys stay with people.
|
|
seal "transit" {
|
|
address = "https://vault.sendico.io"
|
|
mount_path = "transit/"
|
|
key_name = "sxchnge-vault-unseal"
|
|
}
|