feat(hashicorpvault): Initial commit

.gitignore

@@ -1,3 +1,5 @@
+.idea
+
 ### JetBrains template
 # Covers JetBrains IDEs: IntelliJ, RubyMine, PhpStorm, AppCode, PyCharm, CLion, Android Studio, WebStorm and Rider
 # Reference: https://intellij-support.jetbrains.com/hc/en-us/articles/206544839

README.md

@@ -1,3 +1,138 @@
-# vault
+# HashiCorp, Inc. Vault Docker Compose files
 
-Setup instructions for a Hashicorp Vault Docker container
+Docker Compose files to spin up an instance of HashiCorp, Inc. Vault.
+
+# How to run
+
+Add a `COMPOSE_ENV` file and save its location as a shell variable along with the location where this repo lives, here for example `/opt/containers/hashicorpvault` plus all other variables. At [env/fqdn_context.env.example](env/fqdn_context.env.example) you'll find an example environment file.
+
+When everything's ready start HashiCorp, Inc. Vault with Docker Compose, otherwise head down to [Initial setup](#initial-setup) first.
+
+## Environment
+
+```
+export COMPOSE_DIR='/opt/containers/hashicorpvault'
+export COMPOSE_CTX='ux_vilnius'
+export COMPOSE_PROJECT='hashicorpvault-'"${COMPOSE_CTX}"
+export COMPOSE_FILE="${COMPOSE_DIR}"'/compose.yaml'
+export COMPOSE_ENV=<add accordingly>
+```
+
+## Context
+
+On your deployment machine create the necessary Docker context to connect to and control the Docker daemon on whatever target host you'll be using, for example:
+```
+docker context create fully.qualified.domain.name --docker 'host=ssh://root@fully.qualified.domain.name'
+```
+
+## Pull
+
+Pull images from Docker Hub verbatim.
+
+```
+docker compose --project-name "${COMPOSE_PROJECT}" --file "${COMPOSE_FILE}" --file "${COMPOSE_OVERRIDE}" --env-file "${COMPOSE_ENV}" pull
+```
+
+## Copy to target
+
+Copy images to target Docker host, that is assuming you deploy to a machine that itself has no network route to reach Docker Hub or your private registry of choice. Copying in its simplest form involves a local `docker save` and a remote `docker load`. Consider the helper mini-project [quico.space/Quico/copy-docker](https://quico.space/Quico/copy-docker) where [copy-docker.sh](https://quico.space/Quico/copy-docker/src/branch/main/copy-docker.sh) allows the following workflow:
+
+```
+export "$(grep -Pi -- '^HASHICORPVAULT_VERSION=' "${COMPOSE_ENV}")"
+copy-docker 'hashicorp/vault:'"${HASHICORPVAULT_VERSION}" fully.qualified.domain.name
+```
+
+## Start
+
+```
+docker --context 'fully.qualified.domain.name' compose --project-name "${COMPOSE_PROJECT}" --file "${COMPOSE_FILE}" --env-file "${COMPOSE_ENV}" up --detach
+```
+
+## Clean up
+
+Get rid of unnecessary images on both the deployment and the target machine:
+```
+docker --context 'fully.qualified.domain.name' system prune -af
+docker system prune -af
+```
+
+# Initial setup
+
+We're assuming you run Docker Compose workloads with ZFS-based bind mounts. ZFS management, creating a zpool and setting adequate properties for its datasets is out of scope of this document.
+
+## Datasets
+
+Create ZFS datasets and set permissions as needed.
+
+* Parent dateset
+    ```
+    export "$(grep -Pi -- '^CONTEXT=' "${COMPOSE_ENV}")"
+    zfs create -o canmount=off zpool/data/opt
+    zfs create -o mountpoint=/opt/docker-data zpool/data/opt/docker-data
+    ```
+
+* Container-specific datasets
+    ```
+    zfs create -p 'zpool/data/opt/docker-data/hashicorpvault-'"${CONTEXT}"'/config'
+    zfs create -p 'zpool/data/opt/docker-data/hashicorpvault-'"${CONTEXT}"'/data/file'
+    zfs create -p 'zpool/data/opt/docker-data/hashicorpvault-'"${CONTEXT}"'/data/logs'
+    ```
+
+## Additional files
+
+Place a `vault.hcl` file on target server:
+
+```
+hashicorpvault-loft/
+├── config
+│   └── vault.hcl
+└── data
+    ├── file
+    │   ├── ...
+    └── logs
+        └── ...
+```
+
+The file may look like so:
+
+```
+backend "file" {
+    path            = "/vault/file"
+}
+
+listener "tcp" {
+    address         = "0.0.0.0:8200"
+    tls_disable     = 1
+}
+
+api_addr            = "https://fully.qualified.domain.name"
+disable_clustering  = true
+ui                  = true
+```
+
+With the `api_addr` setting in place we assume that you'll be running a separate reverse proxy server that terminates `https://fully.qualified.domain.name` and forwards traffic to Vault. 
+
+When done head back up to [How to run](#how-to-run).
+
+# Development
+
+## Conventional commits
+
+This project uses [Conventional Commits](https://www.conventionalcommits.org/) for its commit messages.
+
+### Commit types
+
+Commit _types_ besides `fix` and `feat` are:
+
+- `refactor`: Keeping functionality while streamlining or otherwise improving function flow
+- `docs`: Documentation for project or components
+
+### Commit scopes
+
+The following _scopes_ are known for this project. A Conventional Commits commit message may optionally use one of the following scopes or none:
+
+- `hashicorpvault`: A change to how the `hashicorpvault` service component works
+- `build`: Build-related changes such as `Dockerfile` fixes and features.
+- `mount`: Volume or bind mount-related changes.
+- `net`: Networking, IP addressing, routing changes
+- `meta`: Affects the project's repo layout, file names etc.

common-settings.yaml

@@ -0,0 +1,11 @@
+services:
+    common-settings:
+        environment:
+            TZ: "${TIMEZONE:-Etc/UTC}"
+        logging:
+            driver: "json-file"
+            options:
+                max-size: "10m"
+                max-file: "10"
+                compress: "true"
+        restart: "${RESTARTPOLICY:-unless-stopped}"

compose.yaml

@@ -0,0 +1,40 @@
+services:
+    hashicorpvault:
+        image: "hashicorp/vault:${HASHICORPVAULT_VERSION}"
+        container_name: "hashicorpvault-${CONTEXT}"
+        cap_add:
+            - IPC_LOCK
+        networks:
+            - hashicorpvault-default
+        ulimits:
+            nproc: ${ULIMIT_NPROC:-65535}
+            nofile:
+                soft: ${ULIMIT_NPROC:-65535}
+                hard: ${ULIMIT_NPROC:-65535}
+        extends:
+            file: common-settings.yml
+            service: common-settings
+        ports:
+            - "63961:8200"
+            - "63962:8201"
+        volumes:
+            - /opt/docker-data/hashicorpvault-${CONTEXT}/data/file:/vault/file
+            - /opt/docker-data/hashicorpvault-${CONTEXT}/data/logs:/vault/logs
+            - /opt/docker-data/hashicorpvault-${CONTEXT}/config:/vault/config
+        environment:
+            VAULT_LOCAL_CONFIG: ${VAULT_LOCAL_CONFIG}
+            VAULT_DEV_ROOT_TOKEN_ID: ${VAULT_DEV_ROOT_TOKEN_ID}
+            VAULT_DEV_LISTEN_ADDRESS: ${VAULT_DEV_LISTEN_ADDRESS}
+        entrypoint: vault server -config=/vault/config/vault.hcl
+networks:
+    # Variables are not supported in keys, only in values.
+    # Change static context string manually if need something else
+    hashicorpvault-default:
+        name: hashicorpvault-${CONTEXT}
+        driver: bridge
+        driver_opts:
+            com.docker.network.enable_ipv6: "false"
+        ipam:
+            driver: default
+            config:
+                - subnet: ${SUBNET}

env/fqdn_context.env.example

@@ -0,0 +1,27 @@
+CONTEXT=ux_vilnius
+
+
+
+# Set something sensible here and uncomment
+# ---
+HASHICORPVAULT_VERSION=latest
+VAULT_DEV_ROOT_TOKEN_ID=your-root-token-here
+VAULT_DEV_LISTEN_ADDRESS=0.0.0.0:1234
+VAULT_LOCAL_CONFIG={"backend": {"file": {"path": "/vault/file"}}, "default_lease_ttl": "168h", "max_lease_ttl": "720h"}
+
+
+
+# Feel free to leave defaults. They apply while these vars are commented out
+# ---
+# RESTARTPOLICY=unless-stopped
+# TIMEZONE=Etc/UTC
+
+
+
+# Subnet to use for this Docker Compose project. Docker defaults to
+# container networks in prefix 172.16.0.0/12 which is 1 million addresses in
+# the range from 172.16.0.0 to 172.31.255.255. Docker uses 172.17.0.0/16 for
+# itself. Use any sensible prefix in 172.16.0.0/12 here except for Docker's
+# own 172.17.0.0/16.
+# ---
+SUBNET=172.30.95.0/24