Jason Woltje
72b1d9f4f2
Convert docker-compose.openbao.yml from standalone Docker Compose to Swarm-compatible format: - Remove container_name, depends_on, restart (not supported in Swarm) - Add deploy.restart_policy sections - Remove 127.0.0.1 port binding (use overlay network instead) - Remove env_file (use Portainer environment instead) - Init sidecar limited to 5 restart attempts with 10s delay Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
88 lines
2.3 KiB
YAML
88 lines
2.3 KiB
YAML
# ==============================================
|
|
# OpenBao Secrets Vault - Swarm / Portainer Stack
|
|
# ==============================================
|
|
#
|
|
# Deploy via Portainer or Docker Swarm:
|
|
# docker stack deploy -c docker-compose.openbao.yml stack-openbao
|
|
#
|
|
# Connects to the main Mosaic stack's overlay network (mosaic_internal).
|
|
# The init sidecar auto-initializes and unseals OpenBao on first run.
|
|
# ==============================================
|
|
|
|
services:
|
|
# ======================
|
|
# OpenBao Secrets Vault
|
|
# ======================
|
|
openbao:
|
|
image: git.mosaicstack.dev/mosaic/stack-openbao:${IMAGE_TAG:-dev}
|
|
command: server -config=/openbao/config/config.hcl
|
|
environment:
|
|
OPENBAO_ADDR: http://0.0.0.0:8200
|
|
volumes:
|
|
- openbao_data:/openbao/data
|
|
- openbao_logs:/openbao/logs
|
|
- openbao_init:/openbao/init
|
|
cap_add:
|
|
- IPC_LOCK
|
|
healthcheck:
|
|
test:
|
|
[
|
|
"CMD",
|
|
"wget",
|
|
"--spider",
|
|
"--quiet",
|
|
"http://localhost:8200/v1/sys/health?standbyok=true&uninitcode=200&sealedcode=200",
|
|
]
|
|
interval: 10s
|
|
timeout: 5s
|
|
retries: 5
|
|
start_period: 30s
|
|
networks:
|
|
- mosaic_internal
|
|
deploy:
|
|
restart_policy:
|
|
condition: on-failure
|
|
|
|
# ======================
|
|
# OpenBao Init Sidecar
|
|
# ======================
|
|
# Auto-initializes and unseals OpenBao on first run.
|
|
# Has built-in retry logic (polls OpenBao API for 60 seconds).
|
|
# After init, runs an unseal watch loop to handle container restarts.
|
|
openbao-init:
|
|
image: git.mosaicstack.dev/mosaic/stack-openbao:${IMAGE_TAG:-dev}
|
|
command: /openbao/init.sh
|
|
environment:
|
|
VAULT_ADDR: http://openbao:8200
|
|
volumes:
|
|
- openbao_init:/openbao/init
|
|
networks:
|
|
- mosaic_internal
|
|
deploy:
|
|
restart_policy:
|
|
condition: on-failure
|
|
max_attempts: 5
|
|
delay: 10s
|
|
|
|
# ======================
|
|
# Volumes
|
|
# ======================
|
|
volumes:
|
|
openbao_data:
|
|
name: mosaic-openbao-data
|
|
driver: local
|
|
openbao_logs:
|
|
name: mosaic-openbao-logs
|
|
driver: local
|
|
openbao_init:
|
|
name: mosaic-openbao-init
|
|
driver: local
|
|
|
|
# ======================
|
|
# Networks
|
|
# ======================
|
|
networks:
|
|
mosaic_internal:
|
|
external: true
|
|
name: mosaic_internal
|