v/infrastructure
1
0
Fork 0
Code Issues 13 Pull requests 1 Projects Releases Packages Activity Actions 2

prep vault geo HA

Browse source
This commit is contained in:
Vivian 2022-09-25 15:17:55 +02:00
parent 6165689b69
commit 6e729ee58b
3 changed files with 24 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
nixos/common/default.nix
View file

@ -67,7 +67,7 @@
}; };
vault-secrets = lib.mkIf (config.networking.domain == "olympus") { vault-secrets = lib.mkIf (config.networking.domain == "olympus") {
vaultPrefix = "secrets/nixos"; vaultPrefix = "olympus_secrets/nixos";
vaultAddress = "http://vault.olympus:8200/"; vaultAddress = "http://vault.olympus:8200/";
approlePrefix = "olympus-${config.networking.hostName}"; approlePrefix = "olympus-${config.networking.hostName}";
}; };

18
nixos/hosts/olympus/vault/configuration.nix
View file

@ -2,8 +2,10 @@
# your system. Help is available in the configuration.nix(5) man page # your system. Help is available in the configuration.nix(5) man page
# and in the NixOS manual (accessible by running ‘nixos-help’). # and in the NixOS manual (accessible by running ‘nixos-help’).
{ config, pkgs, ... }: { config, pkgs, hosts, ... }:
let port = 8200; let
port = 8200;
clusterPort = 8201;
in { in {
# This value determines the NixOS release from which the default # This value determines the NixOS release from which the default
# settings for stateful data, like file locations and database versions # settings for stateful data, like file locations and database versions
@ -17,17 +19,23 @@ in {
environment.systemPackages = with pkgs; [ ]; environment.systemPackages = with pkgs; [ ];
# Vault # Vault
networking.firewall.allowedTCPPorts = [ port ]; networking.firewall.allowedTCPPorts = [ port clusterPort ];
services.vault = { services.vault = {
enable = true; enable = true;
# bin version includes the UI # bin version includes the UI
package = pkgs.vault-bin; package = pkgs.vault-bin;
address = "0.0.0.0:${toString port}"; address = "0.0.0.0:${toString port}";
storageBackend = "file"; storageBackend = "raft";
storagePath = "/var/lib/vault"; storagePath = "/var/lib/vault-raft";
storageConfig = ''
node_id = "olympus-1"
'';
extraConfig = '' extraConfig = ''
ui = true ui = true
disable_mlock = true
api_addr = "http://10.42.42.6:${toString port}"
cluster_addr = "http://10.42.42.6:${toString clusterPort}"
''; '';
}; };
} }

10
nixos/hosts/olympus/vault/migrate.hcl Normal file
View file

@ -0,0 +1,10 @@
storage_source "file" {
path = "/var/lib/vault"
}
storage_destination "raft" {
path = "/var/lib/vault-raft"
node_id = "olympus-1"
}
cluster_addr = "http://vault.olympus:8201"