Vault Docker Compose files

Docker Compose files to spin up an instance of Vault.

How to run

Add a COMPOSE_ENV file and save its location as a shell variable along with the location where this repo lives, here for example /opt/containers/hashicorpvault plus all other variables. At env/fqdn_context.env.example you'll find an example environment file.

When everything's ready start Vault with Docker Compose, otherwise head down to Initial setup first.

Environment

export COMPOSE_DIR='/opt/containers/hashicorpvault'
export COMPOSE_CTX='ux_vilnius'
export COMPOSE_PROJECT='vault-'"${COMPOSE_CTX}"
export COMPOSE_FILE="${COMPOSE_DIR}"'/docker-compose.yml'
export COMPOSE_OVERRIDE="${COMPOSE_DIR%/}"'/docker-compose.override.yml'
export COMPOSE_ENV=<add accordingly>

Build

docker compose --project-name "${COMPOSE_PROJECT}" --file "${COMPOSE_FILE}" --file "${COMPOSE_OVERRIDE}" --env-file "${COMPOSE_ENV}" --profile 'build' build

Context

On your deployment machine create the necessary Docker context to connect to and control the Docker daemon on whatever target host you'll be using, for example:

docker context create fully.qualified.domain.name --docker 'host=ssh://root@fully.qualified.domain.name'

Start

docker --context 'fully.qualified.domain.name' compose --project-name "${COMPOSE_PROJECT}" --file "${COMPOSE_FILE}" --env-file "${COMPOSE_ENV}" up --detach

Initial setup

We're assuming you run Docker Compose workloads with ZFS-based bind mounts. ZFS management, creating a zpool and setting adequate properties for its datasets is out of scope of this document.

Datasets

Create ZFS datasets and set permissions as needed.

Parent dateset

zfs create -o mountpoint=/opt/docker-data 'zpool/docker-data'

Container-specific datasets

zfs create -p 'zpool/docker-data/vault-'"${COMPOSE_CTX}"'/vault/data/db'
zfs create -p 'zpool/docker-data/vault-'"${COMPOSE_CTX}"'/vault/data/logs'
zfs create -p 'zpool/docker-data/vault-'"${COMPOSE_CTX}"'/vault/config'

When changing bind mount locations to real ones remember to also update volumes: in docker-compose.yml.

Create subdirs

mkdir -p '/opt/docker-data/vault-'"${COMPOSE_CTX}"'/vault/'{'.ssh','config','data','projects'}

Change ownership

chown -R 1000:1000 '/opt/docker-data/vault-${COMPOSE_CTX}/vault/data'

Additional files

Place the following files on target server. Use the directory structure at build-context as a guide, specifically at docker-data.

build-context/
├── docker-data
│   └── config
│       └── vault.cfg
├── Dockerfile
└── extras

When done head back up to How to run.

2.8 KiB Raw Blame History