v/infrastructure
1
0
Fork 0
Code Issues 13 Pull requests 1 Projects Releases Packages Activity Actions

modularized vault config

Browse source
This commit is contained in:
Vivian 2022-09-29 18:56:03 +02:00
parent c788303183
commit ca94555776
9 changed files with 120 additions and 104 deletions
Download patch file Download diff file Expand all files Collapse all files

2
nixos/hosts/olympus/default.nix
View file

@ -30,6 +30,7 @@
ip = "10.42.42.6";
mac = "16:2B:87:55:0C:0C";
profile = "vault-0";
tags = [ "vault" ];
}
{
hostname = "mosquitto";
@ -155,6 +156,7 @@
ip = "10.42.42.30";
mac = "26:69:0E:7C:B3:79";
profile = "vault-1";
tags = [ "vault" ];
}
{
hostname = "nuc";

30
nixos/hosts/olympus/vault-0/configuration.nix
View file

@ -3,9 +3,10 @@
# and in the NixOS manual (accessible by running ‘nixos-help’).
{ config, pkgs, hosts, ... }:
let
let
port = 8200;
clusterPort = 8201;
ip = config.deployment.targetHost;
in {
# This value determines the NixOS release from which the default
# settings for stateful data, like file locations and database versions
@ -15,31 +16,10 @@ in {
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
system.stateVersion = "21.05"; # Did you read the comment?
# Additional packages
environment.systemPackages = with pkgs; [ ];
# Vault
networking.firewall.allowedTCPPorts = [ port clusterPort ];
services.vault = {
services.v.vault = {
enable = true;
# bin version includes the UI
package = pkgs.vault-bin;
address = "0.0.0.0:${toString port}";
storageBackend = "raft";
storagePath = "/var/lib/vault-raft";
storageConfig = ''
node_id = "olympus-1"
retry_join {
leader_api_addr = "http://10.42.42.30:${toString port}"
}
'';
extraConfig = ''
ui = true
disable_mlock = true
api_addr = "http://10.42.42.6:${toString port}"
cluster_addr = "http://10.42.42.6:${toString clusterPort}"
'';
openFirewall = true;
node_id = "olympus-1";
};
}

26
nixos/hosts/olympus/vault-1/configuration.nix
View file

@ -15,31 +15,13 @@ in {
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
system.stateVersion = "21.05"; # Did you read the comment?
# Additional packages
environment.systemPackages = with pkgs; [ ];
# Vault
networking.firewall.allowedTCPPorts = [ port clusterPort ];
services.vault = {
# Vault
services.v.vault = {
enable = true;
# bin version includes the UI
package = pkgs.vault-bin;
address = "0.0.0.0:${toString port}";
storageBackend = "raft";
storagePath = "/var/lib/vault-raft";
storageConfig = ''
node_id = "olympus-2"
retry_join {
leader_api_addr = "http://10.42.42.6:${toString port}"
}
'';
extraConfig = ''
ui = true
disable_mlock = true
api_addr = "http://10.42.42.30:${toString port}"
cluster_addr = "http://10.42.42.30:${toString clusterPort}"
'';
openFirewall = true;
node_id = "olympus-2";
};
}