protuberanets
f436b2528c
Two nodes on exch and one on infra-gamma, plain Compose per server, ports on the private addresses only. Nodes unseal through the transit seal on the platform Vault; the transit token reaches only the server process. make prod-images resolves the latest stable Vault release once and pins its digest in ignored .local/prod/images.env, so every node runs the same build. infra/prod/README.md records the layout, the first rollout, node replacement and recovery when the platform Vault is lost (#74).
35 lines
939 B
YAML
35 lines
939 B
YAML
# SXCHNGE production Vault on infra-gamma: node 3 of three (#74). It keeps a
|
|
# copy of the data off exch; nodes 1 and 2 run on exch (exch.yml).
|
|
name: sxchnge-vault
|
|
|
|
services:
|
|
vault-3:
|
|
image: ${VAULT_IMAGE:?Run make prod-images and copy images.env}
|
|
restart: unless-stopped
|
|
cap_add: [IPC_LOCK]
|
|
ulimits: {memlock: {soft: -1, hard: -1}}
|
|
environment:
|
|
VAULT_ADDR: http://127.0.0.1:8200
|
|
SKIP_SETCAP: 'true'
|
|
entrypoint: [/bin/sh, /etc/vault/start.sh]
|
|
secrets: [transit-token]
|
|
healthcheck:
|
|
test: [CMD-SHELL, 'vault status >/dev/null']
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 6
|
|
ports:
|
|
- 192.168.10.98:8200:8200
|
|
- 192.168.10.98:8201:8201
|
|
volumes:
|
|
- vault-3-data:/vault/file
|
|
- ./config/vault-3.hcl:/vault/config/vault.hcl:ro
|
|
- ./start.sh:/etc/vault/start.sh:ro
|
|
|
|
secrets:
|
|
transit-token:
|
|
file: ./secrets/transit-token
|
|
|
|
volumes:
|
|
vault-3-data:
|