diff --git a/.gitignore b/.gitignore index cc26017..dc220db 100644 --- a/.gitignore +++ b/.gitignore @@ -1,3 +1,5 @@ +.idea + ### JetBrains template # Covers JetBrains IDEs: IntelliJ, RubyMine, PhpStorm, AppCode, PyCharm, CLion, Android Studio, WebStorm and Rider # Reference: https://intellij-support.jetbrains.com/hc/en-us/articles/206544839 diff --git a/README.md b/README.md index 4f37d32..51b4aa2 100644 --- a/README.md +++ b/README.md @@ -1,3 +1,138 @@ -# vault +# HashiCorp, Inc. Vault Docker Compose files -Setup instructions for a Hashicorp Vault Docker container \ No newline at end of file +Docker Compose files to spin up an instance of HashiCorp, Inc. Vault. + +# How to run + +Add a `COMPOSE_ENV` file and save its location as a shell variable along with the location where this repo lives, here for example `/opt/containers/hashicorpvault` plus all other variables. At [env/fqdn_context.env.example](env/fqdn_context.env.example) you'll find an example environment file. + +When everything's ready start HashiCorp, Inc. Vault with Docker Compose, otherwise head down to [Initial setup](#initial-setup) first. + +## Environment + +``` +export COMPOSE_DIR='/opt/containers/hashicorpvault' +export COMPOSE_CTX='ux_vilnius' +export COMPOSE_PROJECT='hashicorpvault-'"${COMPOSE_CTX}" +export COMPOSE_FILE="${COMPOSE_DIR}"'/compose.yaml' +export COMPOSE_ENV= +``` + +## Context + +On your deployment machine create the necessary Docker context to connect to and control the Docker daemon on whatever target host you'll be using, for example: +``` +docker context create fully.qualified.domain.name --docker 'host=ssh://root@fully.qualified.domain.name' +``` + +## Pull + +Pull images from Docker Hub verbatim. + +``` +docker compose --project-name "${COMPOSE_PROJECT}" --file "${COMPOSE_FILE}" --file "${COMPOSE_OVERRIDE}" --env-file "${COMPOSE_ENV}" pull +``` + +## Copy to target + +Copy images to target Docker host, that is assuming you deploy to a machine that itself has no network route to reach Docker Hub or your private registry of choice. Copying in its simplest form involves a local `docker save` and a remote `docker load`. Consider the helper mini-project [quico.space/Quico/copy-docker](https://quico.space/Quico/copy-docker) where [copy-docker.sh](https://quico.space/Quico/copy-docker/src/branch/main/copy-docker.sh) allows the following workflow: + +``` +export "$(grep -Pi -- '^HASHICORPVAULT_VERSION=' "${COMPOSE_ENV}")" +copy-docker 'hashicorp/vault:'"${HASHICORPVAULT_VERSION}" fully.qualified.domain.name +``` + +## Start + +``` +docker --context 'fully.qualified.domain.name' compose --project-name "${COMPOSE_PROJECT}" --file "${COMPOSE_FILE}" --env-file "${COMPOSE_ENV}" up --detach +``` + +## Clean up + +Get rid of unnecessary images on both the deployment and the target machine: +``` +docker --context 'fully.qualified.domain.name' system prune -af +docker system prune -af +``` + +# Initial setup + +We're assuming you run Docker Compose workloads with ZFS-based bind mounts. ZFS management, creating a zpool and setting adequate properties for its datasets is out of scope of this document. + +## Datasets + +Create ZFS datasets and set permissions as needed. + +* Parent dateset + ``` + export "$(grep -Pi -- '^CONTEXT=' "${COMPOSE_ENV}")" + zfs create -o canmount=off zpool/data/opt + zfs create -o mountpoint=/opt/docker-data zpool/data/opt/docker-data + ``` + +* Container-specific datasets + ``` + zfs create -p 'zpool/data/opt/docker-data/hashicorpvault-'"${CONTEXT}"'/config' + zfs create -p 'zpool/data/opt/docker-data/hashicorpvault-'"${CONTEXT}"'/data/file' + zfs create -p 'zpool/data/opt/docker-data/hashicorpvault-'"${CONTEXT}"'/data/logs' + ``` + +## Additional files + +Place a `vault.hcl` file on target server: + +``` +hashicorpvault-loft/ +├── config +│ └── vault.hcl +└── data + ├── file + │ ├── ... + └── logs + └── ... +``` + +The file may look like so: + +``` +backend "file" { + path = "/vault/file" +} + +listener "tcp" { + address = "0.0.0.0:8200" + tls_disable = 1 +} + +api_addr = "https://fully.qualified.domain.name" +disable_clustering = true +ui = true +``` + +With the `api_addr` setting in place we assume that you'll be running a separate reverse proxy server that terminates `https://fully.qualified.domain.name` and forwards traffic to Vault. + +When done head back up to [How to run](#how-to-run). + +# Development + +## Conventional commits + +This project uses [Conventional Commits](https://www.conventionalcommits.org/) for its commit messages. + +### Commit types + +Commit _types_ besides `fix` and `feat` are: + +- `refactor`: Keeping functionality while streamlining or otherwise improving function flow +- `docs`: Documentation for project or components + +### Commit scopes + +The following _scopes_ are known for this project. A Conventional Commits commit message may optionally use one of the following scopes or none: + +- `hashicorpvault`: A change to how the `hashicorpvault` service component works +- `build`: Build-related changes such as `Dockerfile` fixes and features. +- `mount`: Volume or bind mount-related changes. +- `net`: Networking, IP addressing, routing changes +- `meta`: Affects the project's repo layout, file names etc. diff --git a/common-settings.yaml b/common-settings.yaml new file mode 100644 index 0000000..9fd26d7 --- /dev/null +++ b/common-settings.yaml @@ -0,0 +1,11 @@ +services: + common-settings: + environment: + TZ: "${TIMEZONE:-Etc/UTC}" + logging: + driver: "json-file" + options: + max-size: "10m" + max-file: "10" + compress: "true" + restart: "${RESTARTPOLICY:-unless-stopped}" diff --git a/compose.yaml b/compose.yaml new file mode 100644 index 0000000..71ae57b --- /dev/null +++ b/compose.yaml @@ -0,0 +1,40 @@ +services: + hashicorpvault: + image: "hashicorp/vault:${HASHICORPVAULT_VERSION}" + container_name: "hashicorpvault-${CONTEXT}" + cap_add: + - IPC_LOCK + networks: + - hashicorpvault-default + ulimits: + nproc: ${ULIMIT_NPROC:-65535} + nofile: + soft: ${ULIMIT_NPROC:-65535} + hard: ${ULIMIT_NPROC:-65535} + extends: + file: common-settings.yml + service: common-settings + ports: + - "63961:8200" + - "63962:8201" + volumes: + - /opt/docker-data/hashicorpvault-${CONTEXT}/data/file:/vault/file + - /opt/docker-data/hashicorpvault-${CONTEXT}/data/logs:/vault/logs + - /opt/docker-data/hashicorpvault-${CONTEXT}/config:/vault/config + environment: + VAULT_LOCAL_CONFIG: ${VAULT_LOCAL_CONFIG} + VAULT_DEV_ROOT_TOKEN_ID: ${VAULT_DEV_ROOT_TOKEN_ID} + VAULT_DEV_LISTEN_ADDRESS: ${VAULT_DEV_LISTEN_ADDRESS} + entrypoint: vault server -config=/vault/config/vault.hcl +networks: + # Variables are not supported in keys, only in values. + # Change static context string manually if need something else + hashicorpvault-default: + name: hashicorpvault-${CONTEXT} + driver: bridge + driver_opts: + com.docker.network.enable_ipv6: "false" + ipam: + driver: default + config: + - subnet: ${SUBNET} diff --git a/env/fqdn_context.env.example b/env/fqdn_context.env.example new file mode 100644 index 0000000..b9d434b --- /dev/null +++ b/env/fqdn_context.env.example @@ -0,0 +1,27 @@ +CONTEXT=ux_vilnius + + + +# Set something sensible here and uncomment +# --- +HASHICORPVAULT_VERSION=latest +VAULT_DEV_ROOT_TOKEN_ID=your-root-token-here +VAULT_DEV_LISTEN_ADDRESS=0.0.0.0:1234 +VAULT_LOCAL_CONFIG={"backend": {"file": {"path": "/vault/file"}}, "default_lease_ttl": "168h", "max_lease_ttl": "720h"} + + + +# Feel free to leave defaults. They apply while these vars are commented out +# --- +# RESTARTPOLICY=unless-stopped +# TIMEZONE=Etc/UTC + + + +# Subnet to use for this Docker Compose project. Docker defaults to +# container networks in prefix 172.16.0.0/12 which is 1 million addresses in +# the range from 172.16.0.0 to 172.31.255.255. Docker uses 172.17.0.0/16 for +# itself. Use any sensible prefix in 172.16.0.0/12 here except for Docker's +# own 172.17.0.0/16. +# --- +SUBNET=172.30.95.0/24 \ No newline at end of file