Skip to content

Instantly share code, notes, and snippets.

@schmichael
Created July 7, 2023 23:24
Show Gist options
  • Save schmichael/c2c932d1bf01c463a6525f65113ef035 to your computer and use it in GitHub Desktop.
Save schmichael/c2c932d1bf01c463a6525f65113ef035 to your computer and use it in GitHub Desktop.
variable "vault_version" {
type = string
default = "1.14.0"
}
job "vault" {
datacenters = ["*"]
type = "service"
group "vault" {
count = 1
network {
mode = "bridge"
port "api" {
static = 8200
to = 8200
}
port "cluster" {
static = 8201
to = 8201
}
}
task "vault.service" {
driver = "exec"
resources {
cpu = 20
memory = 512
}
artifact {
source = "https://releases.hashicorp.com/vault/${var.vault_version}/vault_${var.vault_version}_${attr.kernel.name}_${attr.cpu.arch}.zip"
destination = "${NOMAD_ALLOC_DIR}/artifacts/"
}
template {
data = <<EOH
ui = true
storage "raft" {
path = "{{ env "NOMAD_SECRETS_DIR" }}"
node_id = "{{ env "NOMAD_ALLOC_NAME" | replaceAll "[" "" | replaceAll "]" "" | replaceAll "." "_" }}"
}
listener "tcp" {
address = "0.0.0.0:8200" #"{{ env "NOMAD_ADDR_api" }}"
tls_disable = 1
}
cluster_addr = "http://0.0.0.0:8201" #"http://{{ env "NOMAD_ADDR_cluster" }}"
api_addr = "http://0.0.0.0:8200" #"http://{{ env "NOMAD_ADDR_api" }}"
license_path = "{{ env "NOMAD_SECRETS_DIR" }}/license"
EOH
destination = "${NOMAD_ALLOC_DIR}/configuration/vault.hcl"
}
config {
command = "${NOMAD_ALLOC_DIR}/artifacts/vault"
args = ["server", "-config=${NOMAD_ALLOC_DIR}/configuration/vault.hcl"]
# needed for 1.6.0-beta
# cap_add = ["ipc_lock"]
}
service {
name = "vault-api"
port = "api"
provider = "nomad"
check {
name = "healthy"
type = "http"
path = "/v1/sys/health?sealedcode=210&standbycode=210&performancestandbycode=211&uninintcode=212"
interval = "10s"
timeout = "5s"
}
check {
name = "active"
on_update = "ignore"
type = "http"
path = "/v1/sys/health"
interval = "10s"
timeout = "5s"
}
check {
name = "active_or_standby"
on_update = "ignore"
type = "http"
path = "/v1/sys/health?perfstandbyok=true"
interval = "10s"
timeout = "5s"
}
}
service {
name = "vault-cluster"
port = "cluster"
provider = "nomad"
check {
type = "tcp"
interval = "10s"
timeout = "5s"
}
}
}
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment