Vault Cluster on Docker Swarm with Integrated Storage (raft)

vaul1t.yml

---
version: "3.8"

services:
  vault:
    # image: vault:latest
    image: prologic/vault:dev-ui
    hostname: "{{.Node.Hostname}}"
    environment:
      VAULT_ADDR: "http://127.0.0.1:8200"
      VAULT_LOCAL_CONFIG: >-
        ui            = true

        storage "raft" {
          path       = "/vault/file"
          node_id    = "{{.Node.Hostname}}"
          retry_join {
            auto_join             = "provider=dns query=tasks.vault. server=127.0.0.11"
            auto_join_scheme      = "http"
          }
        }

        api_addr     = "{{`http://{{ GetInterfaceIP \"eth1\" }}:8200`}}"
        cluster_addr = "{{`http://{{ GetInterfaceIP \"eth1\" }}:8201`}}"

        listener "tcp" {
          address         = "0.0.0.0:8200"
          cluster_address = "0.0.0.0:8201"
          tls_disable     = true
        }
    command:
      - server
    cap_add:
      - IPC_LOCK
    volumes:
      - vault:/vault/file
    networks:
      - vault
      - traefik
    deploy:
      mode: global
      placement:
        constraints:
          - "node.role == manager"
      labels:
        - "traefik.enable=true"
        - "traefik.docker.network=traefik"
        - "traefik.http.routers.vault.rule=Host(`vault.${DOMAIN:?DOMAIN not set}`)"
        - "traefik.http.routers.vault.priority=2"
        - "traefik.http.services.vault.loadbalancer.server.port=8200"
        - "traefik.http.services.vault.loadBalancer.sticky.cookie=true"
        - "traefik.http.services.vault.loadBalancer.healthcheck.path=/v1/sys/health"
        - "traefik.http.services.vault.loadBalancer.healthcheck.interval=10s"
        - "traefik.tthp.services.vault.loadBalancer.healthcheck.timeout=2s"
      restart_policy:
        condition: on-failure

networks:
  traefik:
    external: true
  vault:
    driver: overlay
    driver_opts:
      encrypted: "true"

volumes:
  vault:
    driver: local

vault2.yml

---
version: "3.8"

services:
  vault:
    # image: vault:latest
    image: r.mills.io/prologic/vault:dev-ui
    hostname: "vault{{.Task.Slot}}"
    environment:
      VAULT_ADDR: "http://127.0.0.1:8200"
      VAULT_LOCAL_CONFIG: >-
        ui            = true

        storage "raft" {
          path    = "/vault/file"
          node_id = "node{{.Task.Slot}}"
          retry_join {
            leader_api_addr  = "http://vault.vault:8200"
          }
        }

        api_addr     = "http://vault{{.Task.Slot}}:8200"
        cluster_addr = "http://vault{{.Task.Slot}}:8201"

        listener "tcp" {
          address         = "0.0.0.0:8200"
          cluster_address = "0.0.0.0:8201"
          tls_disable     = true
        }
    command:
      - server
    cap_add:
      - IPC_LOCK
    volumes:
      - vault:/vault/file
    networks:
      vault:
        aliases:
          - vault.vault
      traefik:
    deploy:
      replicas: 3
      placement:
        constraints:
          - "node.role == manager"
      labels:
        - "traefik.enable=true"
        - "traefik.docker.network=traefik"
        - "traefik.http.routers.vault.rule=Host(`vault.${DOMAIN:?DOMAIN not set}`)"
        - "traefik.http.routers.vault.priority=2"
        - "traefik.http.services.vault.loadbalancer.server.port=8200"
        - "traefik.http.services.vault.loadBalancer.sticky.cookie=true"
        - "traefik.http.services.vault.loadBalancer.healthcheck.path=/v1/sys/health"
        - "traefik.http.services.vault.loadBalancer.healthcheck.interval=10s"
        - "traefik.tthp.services.vault.loadBalancer.healthcheck.timeout=2s"
      restart_policy:
        condition: any

networks:
  traefik:
    external: true
  vault:
    driver: overlay
    driver_opts:
      encrypted: "true"

volumes:
  vault:
    driver: local