Compare commits
No commits in common. "7dbeced82691bb7699f5a698a7333004de685710" and "765d77177342aac214166a05854df829055849be" have entirely different histories.
7dbeced826
...
765d771773
81
.gitignore
vendored
81
.gitignore
vendored
@ -1,81 +0,0 @@
|
|||||||
.idea
|
|
||||||
|
|
||||||
### JetBrains template
|
|
||||||
# Covers JetBrains IDEs: IntelliJ, RubyMine, PhpStorm, AppCode, PyCharm, CLion, Android Studio, WebStorm and Rider
|
|
||||||
# Reference: https://intellij-support.jetbrains.com/hc/en-us/articles/206544839
|
|
||||||
|
|
||||||
# User-specific stuff
|
|
||||||
.idea/**/workspace.xml
|
|
||||||
.idea/**/tasks.xml
|
|
||||||
.idea/**/usage.statistics.xml
|
|
||||||
.idea/**/dictionaries
|
|
||||||
.idea/**/shelf
|
|
||||||
|
|
||||||
# AWS User-specific
|
|
||||||
.idea/**/aws.xml
|
|
||||||
|
|
||||||
# Generated files
|
|
||||||
.idea/**/contentModel.xml
|
|
||||||
|
|
||||||
# Sensitive or high-churn files
|
|
||||||
.idea/**/dataSources/
|
|
||||||
.idea/**/dataSources.ids
|
|
||||||
.idea/**/dataSources.local.xml
|
|
||||||
.idea/**/sqlDataSources.xml
|
|
||||||
.idea/**/dynamic.xml
|
|
||||||
.idea/**/uiDesigner.xml
|
|
||||||
.idea/**/dbnavigator.xml
|
|
||||||
|
|
||||||
# Gradle
|
|
||||||
.idea/**/gradle.xml
|
|
||||||
.idea/**/libraries
|
|
||||||
|
|
||||||
# Gradle and Maven with auto-import
|
|
||||||
# When using Gradle or Maven with auto-import, you should exclude module files,
|
|
||||||
# since they will be recreated, and may cause churn. Uncomment if using
|
|
||||||
# auto-import.
|
|
||||||
# .idea/artifacts
|
|
||||||
# .idea/compiler.xml
|
|
||||||
# .idea/jarRepositories.xml
|
|
||||||
# .idea/modules.xml
|
|
||||||
# .idea/*.iml
|
|
||||||
# .idea/modules
|
|
||||||
# *.iml
|
|
||||||
# *.ipr
|
|
||||||
|
|
||||||
# CMake
|
|
||||||
cmake-build-*/
|
|
||||||
|
|
||||||
# Mongo Explorer plugin
|
|
||||||
.idea/**/mongoSettings.xml
|
|
||||||
|
|
||||||
# File-based project format
|
|
||||||
*.iws
|
|
||||||
|
|
||||||
# IntelliJ
|
|
||||||
out/
|
|
||||||
|
|
||||||
# mpeltonen/sbt-idea plugin
|
|
||||||
.idea_modules/
|
|
||||||
|
|
||||||
# JIRA plugin
|
|
||||||
atlassian-ide-plugin.xml
|
|
||||||
|
|
||||||
# Cursive Clojure plugin
|
|
||||||
.idea/replstate.xml
|
|
||||||
|
|
||||||
# SonarLint plugin
|
|
||||||
.idea/sonarlint/
|
|
||||||
|
|
||||||
# Crashlytics plugin (for Android Studio and IntelliJ)
|
|
||||||
com_crashlytics_export_strings.xml
|
|
||||||
crashlytics.properties
|
|
||||||
crashlytics-build.properties
|
|
||||||
fabric.properties
|
|
||||||
|
|
||||||
# Editor-based Rest Client
|
|
||||||
.idea/httpRequests
|
|
||||||
|
|
||||||
# Android studio 3.1+ serialized cache file
|
|
||||||
.idea/caches/build_file_checksums.ser
|
|
||||||
|
|
||||||
139
README.md
139
README.md
@ -1,138 +1,3 @@
|
|||||||
# HashiCorp, Inc. Vault Docker Compose files
|
# vault
|
||||||
|
|
||||||
Docker Compose files to spin up an instance of HashiCorp, Inc. Vault.
|
Setup instructions for a Hashicorp Vault Docker container
|
||||||
|
|
||||||
# How to run
|
|
||||||
|
|
||||||
Add a `COMPOSE_ENV` file and save its location as a shell variable along with the location where this repo lives, here for example `/opt/containers/hashicorpvault` plus all other variables. At [env/fqdn_context.env.example](env/fqdn_context.env.example) you'll find an example environment file.
|
|
||||||
|
|
||||||
When everything's ready start HashiCorp, Inc. Vault with Docker Compose, otherwise head down to [Initial setup](#initial-setup) first.
|
|
||||||
|
|
||||||
## Environment
|
|
||||||
|
|
||||||
```
|
|
||||||
export COMPOSE_DIR='/opt/containers/hashicorpvault'
|
|
||||||
export COMPOSE_CTX='ux_vilnius'
|
|
||||||
export COMPOSE_PROJECT='hashicorpvault-'"${COMPOSE_CTX}"
|
|
||||||
export COMPOSE_FILE="${COMPOSE_DIR}"'/compose.yaml'
|
|
||||||
export COMPOSE_ENV=<add accordingly>
|
|
||||||
```
|
|
||||||
|
|
||||||
## Context
|
|
||||||
|
|
||||||
On your deployment machine create the necessary Docker context to connect to and control the Docker daemon on whatever target host you'll be using, for example:
|
|
||||||
```
|
|
||||||
docker context create fully.qualified.domain.name --docker 'host=ssh://root@fully.qualified.domain.name'
|
|
||||||
```
|
|
||||||
|
|
||||||
## Pull
|
|
||||||
|
|
||||||
Pull images from Docker Hub verbatim.
|
|
||||||
|
|
||||||
```
|
|
||||||
docker compose --project-name "${COMPOSE_PROJECT}" --file "${COMPOSE_FILE}" --file "${COMPOSE_OVERRIDE}" --env-file "${COMPOSE_ENV}" pull
|
|
||||||
```
|
|
||||||
|
|
||||||
## Copy to target
|
|
||||||
|
|
||||||
Copy images to target Docker host, that is assuming you deploy to a machine that itself has no network route to reach Docker Hub or your private registry of choice. Copying in its simplest form involves a local `docker save` and a remote `docker load`. Consider the helper mini-project [quico.space/Quico/copy-docker](https://quico.space/Quico/copy-docker) where [copy-docker.sh](https://quico.space/Quico/copy-docker/src/branch/main/copy-docker.sh) allows the following workflow:
|
|
||||||
|
|
||||||
```
|
|
||||||
export "$(grep -Pi -- '^HASHICORPVAULT_VERSION=' "${COMPOSE_ENV}")"
|
|
||||||
copy-docker 'hashicorp/vault:'"${HASHICORPVAULT_VERSION}" fully.qualified.domain.name
|
|
||||||
```
|
|
||||||
|
|
||||||
## Start
|
|
||||||
|
|
||||||
```
|
|
||||||
docker --context 'fully.qualified.domain.name' compose --project-name "${COMPOSE_PROJECT}" --file "${COMPOSE_FILE}" --env-file "${COMPOSE_ENV}" up --detach
|
|
||||||
```
|
|
||||||
|
|
||||||
## Clean up
|
|
||||||
|
|
||||||
Get rid of unnecessary images on both the deployment and the target machine:
|
|
||||||
```
|
|
||||||
docker --context 'fully.qualified.domain.name' system prune -af
|
|
||||||
docker system prune -af
|
|
||||||
```
|
|
||||||
|
|
||||||
# Initial setup
|
|
||||||
|
|
||||||
We're assuming you run Docker Compose workloads with ZFS-based bind mounts. ZFS management, creating a zpool and setting adequate properties for its datasets is out of scope of this document.
|
|
||||||
|
|
||||||
## Datasets
|
|
||||||
|
|
||||||
Create ZFS datasets and set permissions as needed.
|
|
||||||
|
|
||||||
* Parent dateset
|
|
||||||
```
|
|
||||||
export "$(grep -Pi -- '^CONTEXT=' "${COMPOSE_ENV}")"
|
|
||||||
zfs create -o canmount=off zpool/data/opt
|
|
||||||
zfs create -o mountpoint=/opt/docker-data zpool/data/opt/docker-data
|
|
||||||
```
|
|
||||||
|
|
||||||
* Container-specific datasets
|
|
||||||
```
|
|
||||||
zfs create -p 'zpool/data/opt/docker-data/hashicorpvault-'"${CONTEXT}"'/config'
|
|
||||||
zfs create -p 'zpool/data/opt/docker-data/hashicorpvault-'"${CONTEXT}"'/data/file'
|
|
||||||
zfs create -p 'zpool/data/opt/docker-data/hashicorpvault-'"${CONTEXT}"'/data/logs'
|
|
||||||
```
|
|
||||||
|
|
||||||
## Additional files
|
|
||||||
|
|
||||||
Place a `vault.hcl` file on target server:
|
|
||||||
|
|
||||||
```
|
|
||||||
hashicorpvault-loft/
|
|
||||||
├── config
|
|
||||||
│ └── vault.hcl
|
|
||||||
└── data
|
|
||||||
├── file
|
|
||||||
│ ├── ...
|
|
||||||
└── logs
|
|
||||||
└── ...
|
|
||||||
```
|
|
||||||
|
|
||||||
The file may look like so:
|
|
||||||
|
|
||||||
```
|
|
||||||
backend "file" {
|
|
||||||
path = "/vault/file"
|
|
||||||
}
|
|
||||||
|
|
||||||
listener "tcp" {
|
|
||||||
address = "0.0.0.0:8200"
|
|
||||||
tls_disable = 1
|
|
||||||
}
|
|
||||||
|
|
||||||
api_addr = "https://fully.qualified.domain.name"
|
|
||||||
disable_clustering = true
|
|
||||||
ui = true
|
|
||||||
```
|
|
||||||
|
|
||||||
With the `api_addr` setting in place we assume that you'll be running a separate reverse proxy server that terminates `https://fully.qualified.domain.name` and forwards traffic to Vault.
|
|
||||||
|
|
||||||
When done head back up to [How to run](#how-to-run).
|
|
||||||
|
|
||||||
# Development
|
|
||||||
|
|
||||||
## Conventional commits
|
|
||||||
|
|
||||||
This project uses [Conventional Commits](https://www.conventionalcommits.org/) for its commit messages.
|
|
||||||
|
|
||||||
### Commit types
|
|
||||||
|
|
||||||
Commit _types_ besides `fix` and `feat` are:
|
|
||||||
|
|
||||||
- `refactor`: Keeping functionality while streamlining or otherwise improving function flow
|
|
||||||
- `docs`: Documentation for project or components
|
|
||||||
|
|
||||||
### Commit scopes
|
|
||||||
|
|
||||||
The following _scopes_ are known for this project. A Conventional Commits commit message may optionally use one of the following scopes or none:
|
|
||||||
|
|
||||||
- `hashicorpvault`: A change to how the `hashicorpvault` service component works
|
|
||||||
- `build`: Build-related changes such as `Dockerfile` fixes and features.
|
|
||||||
- `mount`: Volume or bind mount-related changes.
|
|
||||||
- `net`: Networking, IP addressing, routing changes
|
|
||||||
- `meta`: Affects the project's repo layout, file names etc.
|
|
||||||
@ -1,11 +0,0 @@
|
|||||||
services:
|
|
||||||
common-settings:
|
|
||||||
environment:
|
|
||||||
TZ: "${TIMEZONE:-Etc/UTC}"
|
|
||||||
logging:
|
|
||||||
driver: "json-file"
|
|
||||||
options:
|
|
||||||
max-size: "10m"
|
|
||||||
max-file: "10"
|
|
||||||
compress: "true"
|
|
||||||
restart: "${RESTARTPOLICY:-unless-stopped}"
|
|
||||||
40
compose.yaml
40
compose.yaml
@ -1,40 +0,0 @@
|
|||||||
services:
|
|
||||||
hashicorpvault:
|
|
||||||
image: "hashicorp/vault:${HASHICORPVAULT_VERSION}"
|
|
||||||
container_name: "hashicorpvault-${CONTEXT}"
|
|
||||||
cap_add:
|
|
||||||
- IPC_LOCK
|
|
||||||
networks:
|
|
||||||
- hashicorpvault-default
|
|
||||||
ulimits:
|
|
||||||
nproc: ${ULIMIT_NPROC:-65535}
|
|
||||||
nofile:
|
|
||||||
soft: ${ULIMIT_NPROC:-65535}
|
|
||||||
hard: ${ULIMIT_NPROC:-65535}
|
|
||||||
extends:
|
|
||||||
file: common-settings.yml
|
|
||||||
service: common-settings
|
|
||||||
ports:
|
|
||||||
- "63961:8200"
|
|
||||||
- "63962:8201"
|
|
||||||
volumes:
|
|
||||||
- /opt/docker-data/hashicorpvault-${CONTEXT}/data/file:/vault/file
|
|
||||||
- /opt/docker-data/hashicorpvault-${CONTEXT}/data/logs:/vault/logs
|
|
||||||
- /opt/docker-data/hashicorpvault-${CONTEXT}/config:/vault/config
|
|
||||||
environment:
|
|
||||||
VAULT_LOCAL_CONFIG: ${VAULT_LOCAL_CONFIG}
|
|
||||||
VAULT_DEV_ROOT_TOKEN_ID: ${VAULT_DEV_ROOT_TOKEN_ID}
|
|
||||||
VAULT_DEV_LISTEN_ADDRESS: ${VAULT_DEV_LISTEN_ADDRESS}
|
|
||||||
entrypoint: vault server -config=/vault/config/vault.hcl
|
|
||||||
networks:
|
|
||||||
# Variables are not supported in keys, only in values.
|
|
||||||
# Change static context string manually if need something else
|
|
||||||
hashicorpvault-default:
|
|
||||||
name: hashicorpvault-${CONTEXT}
|
|
||||||
driver: bridge
|
|
||||||
driver_opts:
|
|
||||||
com.docker.network.enable_ipv6: "false"
|
|
||||||
ipam:
|
|
||||||
driver: default
|
|
||||||
config:
|
|
||||||
- subnet: ${SUBNET}
|
|
||||||
27
env/fqdn_context.env.example
vendored
27
env/fqdn_context.env.example
vendored
@ -1,27 +0,0 @@
|
|||||||
CONTEXT=ux_vilnius
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
# Set something sensible here and uncomment
|
|
||||||
# ---
|
|
||||||
HASHICORPVAULT_VERSION=latest
|
|
||||||
VAULT_DEV_ROOT_TOKEN_ID=your-root-token-here
|
|
||||||
VAULT_DEV_LISTEN_ADDRESS=0.0.0.0:1234
|
|
||||||
VAULT_LOCAL_CONFIG={"backend": {"file": {"path": "/vault/file"}}, "default_lease_ttl": "168h", "max_lease_ttl": "720h"}
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
# Feel free to leave defaults. They apply while these vars are commented out
|
|
||||||
# ---
|
|
||||||
# RESTARTPOLICY=unless-stopped
|
|
||||||
# TIMEZONE=Etc/UTC
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
# Subnet to use for this Docker Compose project. Docker defaults to
|
|
||||||
# container networks in prefix 172.16.0.0/12 which is 1 million addresses in
|
|
||||||
# the range from 172.16.0.0 to 172.31.255.255. Docker uses 172.17.0.0/16 for
|
|
||||||
# itself. Use any sensible prefix in 172.16.0.0/12 here except for Docker's
|
|
||||||
# own 172.17.0.0/16.
|
|
||||||
# ---
|
|
||||||
SUBNET=172.30.95.0/24
|
|
||||||
Loading…
x
Reference in New Issue
Block a user