prep vault geo HA
This commit is contained in:
parent
6165689b69
commit
6e729ee58b
3 changed files with 24 additions and 6 deletions
|
@ -67,7 +67,7 @@
|
|||
};
|
||||
|
||||
vault-secrets = lib.mkIf (config.networking.domain == "olympus") {
|
||||
vaultPrefix = "secrets/nixos";
|
||||
vaultPrefix = "olympus_secrets/nixos";
|
||||
vaultAddress = "http://vault.olympus:8200/";
|
||||
approlePrefix = "olympus-${config.networking.hostName}";
|
||||
};
|
||||
|
|
|
@ -2,8 +2,10 @@
|
|||
# your system. Help is available in the configuration.nix(5) man page
|
||||
# and in the NixOS manual (accessible by running ‘nixos-help’).
|
||||
|
||||
{ config, pkgs, ... }:
|
||||
let port = 8200;
|
||||
{ config, pkgs, hosts, ... }:
|
||||
let
|
||||
port = 8200;
|
||||
clusterPort = 8201;
|
||||
in {
|
||||
# This value determines the NixOS release from which the default
|
||||
# settings for stateful data, like file locations and database versions
|
||||
|
@ -17,17 +19,23 @@ in {
|
|||
environment.systemPackages = with pkgs; [ ];
|
||||
|
||||
# Vault
|
||||
networking.firewall.allowedTCPPorts = [ port ];
|
||||
networking.firewall.allowedTCPPorts = [ port clusterPort ];
|
||||
|
||||
services.vault = {
|
||||
enable = true;
|
||||
# bin version includes the UI
|
||||
package = pkgs.vault-bin;
|
||||
address = "0.0.0.0:${toString port}";
|
||||
storageBackend = "file";
|
||||
storagePath = "/var/lib/vault";
|
||||
storageBackend = "raft";
|
||||
storagePath = "/var/lib/vault-raft";
|
||||
storageConfig = ''
|
||||
node_id = "olympus-1"
|
||||
'';
|
||||
extraConfig = ''
|
||||
ui = true
|
||||
disable_mlock = true
|
||||
api_addr = "http://10.42.42.6:${toString port}"
|
||||
cluster_addr = "http://10.42.42.6:${toString clusterPort}"
|
||||
'';
|
||||
};
|
||||
}
|
||||
|
|
10
nixos/hosts/olympus/vault/migrate.hcl
Normal file
10
nixos/hosts/olympus/vault/migrate.hcl
Normal file
|
@ -0,0 +1,10 @@
|
|||
storage_source "file" {
|
||||
path = "/var/lib/vault"
|
||||
}
|
||||
|
||||
storage_destination "raft" {
|
||||
path = "/var/lib/vault-raft"
|
||||
node_id = "olympus-1"
|
||||
}
|
||||
|
||||
cluster_addr = "http://vault.olympus:8201"
|
Loading…
Reference in a new issue