Skip to content

Instantly share code, notes, and snippets.

@prologic
Last active September 8, 2022 06:11
Show Gist options
  • Save prologic/df9d97d5acb9183adb7357c8f422faca to your computer and use it in GitHub Desktop.
Save prologic/df9d97d5acb9183adb7357c8f422faca to your computer and use it in GitHub Desktop.
Vault Cluster on Docker Swarm with Integrated Storage (raft)
---
version: "3.8"
services:
vault:
# image: vault:latest
image: prologic/vault:dev-ui
hostname: "{{.Node.Hostname}}"
environment:
VAULT_ADDR: "http://127.0.0.1:8200"
VAULT_LOCAL_CONFIG: >-
ui = true
storage "raft" {
path = "/vault/file"
node_id = "{{.Node.Hostname}}"
retry_join {
auto_join = "provider=dns query=tasks.vault. server=127.0.0.11"
auto_join_scheme = "http"
}
}
api_addr = "{{`http://{{ GetInterfaceIP \"eth1\" }}:8200`}}"
cluster_addr = "{{`http://{{ GetInterfaceIP \"eth1\" }}:8201`}}"
listener "tcp" {
address = "0.0.0.0:8200"
cluster_address = "0.0.0.0:8201"
tls_disable = true
}
command:
- server
cap_add:
- IPC_LOCK
volumes:
- vault:/vault/file
networks:
- vault
- traefik
deploy:
mode: global
placement:
constraints:
- "node.role == manager"
labels:
- "traefik.enable=true"
- "traefik.docker.network=traefik"
- "traefik.http.routers.vault.rule=Host(`vault.${DOMAIN:?DOMAIN not set}`)"
- "traefik.http.routers.vault.priority=2"
- "traefik.http.services.vault.loadbalancer.server.port=8200"
- "traefik.http.services.vault.loadBalancer.sticky.cookie=true"
- "traefik.http.services.vault.loadBalancer.healthcheck.path=/v1/sys/health"
- "traefik.http.services.vault.loadBalancer.healthcheck.interval=10s"
- "traefik.tthp.services.vault.loadBalancer.healthcheck.timeout=2s"
restart_policy:
condition: on-failure
networks:
traefik:
external: true
vault:
driver: overlay
driver_opts:
encrypted: "true"
volumes:
vault:
driver: local
---
version: "3.8"
services:
vault:
# image: vault:latest
image: r.mills.io/prologic/vault:dev-ui
hostname: "vault{{.Task.Slot}}"
environment:
VAULT_ADDR: "http://127.0.0.1:8200"
VAULT_LOCAL_CONFIG: >-
ui = true
storage "raft" {
path = "/vault/file"
node_id = "node{{.Task.Slot}}"
retry_join {
leader_api_addr = "http://vault.vault:8200"
}
}
api_addr = "http://vault{{.Task.Slot}}:8200"
cluster_addr = "http://vault{{.Task.Slot}}:8201"
listener "tcp" {
address = "0.0.0.0:8200"
cluster_address = "0.0.0.0:8201"
tls_disable = true
}
command:
- server
cap_add:
- IPC_LOCK
volumes:
- vault:/vault/file
networks:
vault:
aliases:
- vault.vault
traefik:
deploy:
replicas: 3
placement:
constraints:
- "node.role == manager"
labels:
- "traefik.enable=true"
- "traefik.docker.network=traefik"
- "traefik.http.routers.vault.rule=Host(`vault.${DOMAIN:?DOMAIN not set}`)"
- "traefik.http.routers.vault.priority=2"
- "traefik.http.services.vault.loadbalancer.server.port=8200"
- "traefik.http.services.vault.loadBalancer.sticky.cookie=true"
- "traefik.http.services.vault.loadBalancer.healthcheck.path=/v1/sys/health"
- "traefik.http.services.vault.loadBalancer.healthcheck.interval=10s"
- "traefik.tthp.services.vault.loadBalancer.healthcheck.timeout=2s"
restart_policy:
condition: any
networks:
traefik:
external: true
vault:
driver: overlay
driver_opts:
encrypted: "true"
volumes:
vault:
driver: local
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment