vault-setup/docker-compose-prod.yml at main · SingleDraw/vault-setup · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
services:
  consul:
    image: hashicorp/consul:1.21
    container_name: consul # used as service name in hcl files
    ports:
      - "8500:8500"
    command: "agent -server -bootstrap-expect=1 -ui -client=0.0.0.0 -data-dir=/consul/data"
    volumes:
      - consul_data:/consul/data
    healthcheck:
      test: ["CMD", "consul", "members"]
      interval: 10s
      timeout: 5s
      retries: 5

  # Master vault - handles unsealing keys (prod mode)
  vault-unsealer:
    image: hashicorp/vault:latest
    container_name: vault-unsealer
    ports:
      - "8201:8200"  # External access on 8201
    environment:
      VAULT_DEV_LISTEN_ADDRESS: 0.0.0.0:8200
      VAULT_ADDR: http://0.0.0.0:8200
    cap_add:
      - IPC_LOCK
    volumes:
      - ./vault-config/prod/unsealer:/vault/config
    command: vault server -config=/vault/config/unsealer.hcl
    healthcheck:
      test: ["CMD", "vault", "status"]
      interval: 10s
      timeout: 5s
      retries: 5

  # MMain application vault
  vault:
    image: hashicorp/vault:latest
    container_name: vault
    ports:
      - "8200:8200"
    environment:
      VAULT_DEV_LISTEN_ADDRESS: 0.0.0.0:8200
      UNSEALER_TOKEN: ${UNSEALER_TOKEN:-}       # Pass this differently in production
      VAULT_ADDR: http://0.0.0.0:8200
    cap_add:
      - IPC_LOCK  # For Vault to lock memory (prevents sensitive data from being swapped to disk)
    volumes:
      - vault-data:/vault/data
      - vault-logs:/vault/logs
      - ./vault-config/prod/main:/vault/config
    entrypoint: /vault/config/entrypoint.sh
    command: vault server -config=/vault/config/vault.hcl
    healthcheck:
      test: ["CMD", "vault", "status"]
      interval: 30s
      timeout: 10s
      retries: 3
    depends_on:
      - consul
      - vault-unsealer

  # Vault Agent
  vault-agent:
    image: hashicorp/vault:latest
    container_name: vault-agent
    volumes:
      - ./vault-config/prod/agent:/vault/config # Configuration files for Vault Agent, with creds/role_id
      - vault-agent-data:/vault/agent-data
    environment:
      VAULT_ADDR: http://vault:8200
    # command: >
    #   vault agent -config=/vault/config/agent.hcl
    # Debug command to keep the container running for debugging
    command: >
      sh -c "vault agent -config=/vault/config/agent.hcl || (echo 'Vault agent failed, sleeping for debug'; sleep 3600)"
    depends_on:
      - vault

volumes:
  consul_data:
  vault-data:
  vault-logs:
  vault-agent-data: # Data for Vault Agent to store and share the agent token with the client app
    name: vault-agent-data