Jason Woltje
7c01352ab5
Some checks failed
ci/woodpecker/push/woodpecker Pipeline failed
- Add explicit command: server -config=/openbao/config/config.hcl - Remove OPENBAO_DEV_ROOT_TOKEN_ID (not needed in production) - Fixes 'address already in use' error caused by dev mode conflict The base OpenBao image defaults to 'server -dev' which conflicts with our production config.hcl. This change forces production mode. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
94 lines
2.4 KiB
YAML
94 lines
2.4 KiB
YAML
# ==============================================
|
|
# OpenBao Standalone Deployment
|
|
# ==============================================
|
|
#
|
|
# IMPORTANT: This file deploys OpenBao as a STANDALONE container.
|
|
# Do NOT include this in docker stack deploy - it will fail due to port binding conflicts.
|
|
#
|
|
# Usage:
|
|
# docker compose -f docker-compose.openbao.yml up -d
|
|
#
|
|
# This is required when:
|
|
# - Using Docker Swarm (stateful services don't work well in swarm)
|
|
# - You want OpenBao isolated from the main stack
|
|
#
|
|
# Alternative: Use external HashiCorp Vault or managed secrets service
|
|
# ==============================================
|
|
|
|
services:
|
|
# ======================
|
|
# OpenBao Secrets Vault
|
|
# ======================
|
|
openbao:
|
|
image: git.mosaicstack.dev/mosaic/stack-openbao:${IMAGE_TAG:-dev}
|
|
container_name: mosaic-openbao
|
|
command: server -config=/openbao/config/config.hcl
|
|
env_file: .env
|
|
environment:
|
|
OPENBAO_ADDR: http://0.0.0.0:8200
|
|
ports:
|
|
- "127.0.0.1:${OPENBAO_PORT:-8200}:8200" # Localhost only for security
|
|
volumes:
|
|
- openbao_data:/openbao/data
|
|
- openbao_logs:/openbao/logs
|
|
- openbao_init:/openbao/init
|
|
cap_add:
|
|
- IPC_LOCK
|
|
healthcheck:
|
|
test:
|
|
- CMD
|
|
- wget
|
|
- --spider
|
|
- --quiet
|
|
- http://localhost:8200/v1/sys/health?standbyok=true
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 5
|
|
start_period: 30s
|
|
restart: unless-stopped
|
|
networks:
|
|
- mosaic_internal
|
|
|
|
# ======================
|
|
# OpenBao Init Sidecar
|
|
# ======================
|
|
# Auto-initializes and unseals OpenBao on first run
|
|
openbao-init:
|
|
image: git.mosaicstack.dev/mosaic/stack-openbao:${IMAGE_TAG:-dev}
|
|
container_name: mosaic-openbao-init
|
|
env_file: .env
|
|
command: /openbao/init.sh
|
|
environment:
|
|
OPENBAO_ADDR: http://openbao:8200
|
|
volumes:
|
|
- openbao_init:/openbao/init
|
|
depends_on:
|
|
openbao:
|
|
condition: service_healthy
|
|
restart: "no"
|
|
networks:
|
|
- mosaic_internal
|
|
|
|
# ======================
|
|
# Volumes
|
|
# ======================
|
|
volumes:
|
|
openbao_data:
|
|
name: mosaic-openbao-data
|
|
driver: local
|
|
openbao_logs:
|
|
name: mosaic-openbao-logs
|
|
driver: local
|
|
openbao_init:
|
|
name: mosaic-openbao-init
|
|
driver: local
|
|
|
|
# ======================
|
|
# Networks
|
|
# ======================
|
|
# Connect to the swarm stack's internal network
|
|
networks:
|
|
mosaic_internal:
|
|
external: true
|
|
name: mosaic_internal
|