vault-setup/docker-compose-dev.yml at main · SingleDraw/vault-setup · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
services:
  consul:
    image: hashicorp/consul:1.21
    container_name: consul # used as service name in hcl files
    ports:
      - "8500:8500"
    command: >
      consul agent
      -server
      -bootstrap-expect=1
      -ui
      -client=0.0.0.0
      -data-dir=/consul/data
    volumes:
      - consul_data:/consul/data
    healthcheck:
      test: ["CMD", "consul", "members"]
      interval: 10s
      timeout: 5s
      retries: 5

  # Master vault - handles unsealing keys (dev mode for simplicity)
  vault-unsealer:
    image: hashicorp/vault:latest
    container_name: vault-unsealer
    ports:
      - "8201:8200"  # External access on 8201
    environment:
      VAULT_DEV_ROOT_TOKEN_ID: ${UNSEALER_TOKEN:-unsealer-root-token}
      VAULT_DEV_LISTEN_ADDRESS: 0.0.0.0:8200
      VAULT_ADDR: http://0.0.0.0:8200
    cap_add:
      - IPC_LOCK
    healthcheck:
      test: ["CMD", "vault", "status"]
      interval: 10s
      timeout: 5s
      retries: 5

  # MMain application vault
  vault:
    image: hashicorp/vault:latest
    container_name: vault
    ports:
      - "8200:8200"
    environment:
      VAULT_DEV_LISTEN_ADDRESS: 0.0.0.0:8200
      VAULT_ADDR: http://0.0.0.0:8200
    cap_add:
      - IPC_LOCK
    volumes:
      - vault-data:/vault/data
      - vault-logs:/vault/logs
      - ./vault-config/dev:/vault/config
    command: >
      vault server
      -config=/vault/config/vault.hcl
    healthcheck:
      test: ["CMD", "vault", "status"]
      interval: 30s
      timeout: 10s
      retries: 3
    depends_on:
      - consul
      - vault-unsealer

  vault-ui:
    image: djenriquez/vault-ui:latest
    container_name: vault-ui
    ports:
      - "8000:8000"
    environment:
      VAULT_URL_DEFAULT: http://vault:8200
      VAULT_AUTH_DEFAULT: TOKEN
    depends_on:
      - vault

volumes:
  consul_data:
  vault-data:
  vault-logs: