docker-compose.yml

version: "3.7"

x-container-common: &container-common
  image: consensys/quorum-hashicorp-vault-plugin:latest
  networks:
    - vault

services:
  vault:
    <<: *container-common
    tty: true
    restart: "no"
    cap_add:
      - IPC_LOCK
    environment:
      ROOT_TOKEN_PATH: /vault/token/.root
      VAULT_ADDR: http://vault:8200
      PLUGIN_MOUNT_PATH: quorum
      KVV2_MOUNT_PATH: secret
      VAULT_IS_READY: /vault/token/.ready
    ports:
      - 8200:8200
    volumes:
      - token:/vault/token
      - ./scripts/vault-init.sh:/usr/local/bin/init.sh
    entrypoint:
      - sh
      - -c
      - |
        cat <<EOF > /vault/config.hcl
            backend "file" {
              path = "/vault/file"
            }

            listener "tcp" {
              address = "vault:8200"
              tls_disable = true
            }

            default_lease_ttl = "15m"
            max_lease_ttl = "30m"
            api_addr = "http://vault:8200"
            plugin_directory = "/vault/plugins"
            log_level = "Debug"
        EOF

        ( sleep 2 ; init.sh && cat > $${VAULT_IS_READY}) &
        vault server -config=/vault/config.hcl
    healthcheck:
      test: [ "CMD", "wget", "--spider", "--proxy", "off", "http://localhost:8200/v1/sys/health?standbyok=true" ]
      interval: 10s
      timeout: 3s
      retries: 10
      start_period: 5s

  vault-ssl:
    <<: *container-common
    tty: true
    container_name: vault
    restart: "no"
    cap_add:
      - IPC_LOCK
    ports:
      - 8200:8200
    depends_on:
      - generate-certs
    volumes:
      - token:/vault/token
      - tls:/vault/tls
      - ./scripts/vault-init.sh:/usr/local/bin/init.sh
    environment:
      ROOT_TOKEN_PATH: /vault/token/.root
      VAULT_ADDR: https://vault:8200
      PLUGIN_MOUNT_PATH: quorum
      VAULT_IS_READY: /vault/token/.ready
      VAULT_CACERT: ${VAULT_CACERT-/vault/tls/ca.crt}
      VAULT_CLIENT_CERT: ${VAULT_CLIENT_CERT-/vault/tls/client.crt}
      VAULT_CLIENT_KEY: ${VAULT_CLIENT_KEY-/vault/tls/client.key}
      VAULT_SERVER_CERT: ${VAULT_SERVER_CERT-/vault/tls/tls.crt}
      VAULT_SERVER_KEY: ${VAULT_SERVER_KEY-/vault/tls/tls.key}
    entrypoint:
      - sh
      - -c
      - |
        cat <<EOF > /vault/config.hcl
            backend "file" {
              path = "/vault/file"
            }

            listener "tcp" {
              address = "vault:8200"
              tls_disable = false
              tls_client_ca_file = "$${VAULT_CACERT}"
              tls_cert_file = "$${VAULT_SERVER_CERT}"
              tls_key_file = "$${VAULT_SERVER_KEY}"
            }

            default_lease_ttl = "15m"
            max_lease_ttl = "30m"
            api_addr = "https://vault:8200"
            plugin_directory = "/vault/plugins"
            log_level = "Debug"
        EOF

        until [ -f $${VAULT_SERVER_CERT} ]; do
          echo "[INIT] waiting for $${VAULT_SERVER_CERT} to be ready..."
          sleep 1
        done

        ( sleep 2 ; init.sh && cat > $${VAULT_IS_READY}) &
        vault server -config=/vault/config.hcl
    healthcheck:
      test: [ "CMD", "wget", "--spider", "--proxy", "off", "https://localhost:8200/v1/sys/health?standbyok=true" ]
      interval: 10s
      timeout: 3s
      retries: 10
      start_period: 5s
      
  generate-certs:
    image: golang:1.16
    tty: true
    restart: "no"
    volumes:
      - tls:/vault/tls
      - ./deps/cfssl:/config
      - ./scripts/generate-pki.sh:/usr/local/bin/init.sh
    environment:
      CONF_DIR: /config
      DEST_CERT_PATH: /vault/tls/
    entrypoint:
      - sh
      - -c
      - |

        go get github.com/cloudflare/cfssl/cmd/cfssl
        go get github.com/cloudflare/cfssl/cmd/cfssljson

        init.sh

  agent:
    <<: *container-common
    tty: true
    depends_on:
      - vault
    cap_add:
      - IPC_LOCK
    environment:
      PLUGIN_MOUNT_PATH: quorum
      ROOT_TOKEN_PATH: /vault/token/.root
      VAULT_ADDR: http://vault:8200
      SECRET_FILE_PATH: /vault/token/secret
      ROLE_FILE_PATH: /vault/token/role
      VAULT_IS_READY: /vault/token/.ready
      CAPABILITIES: '[\"create\", \"read\", \"update\", \"delete\", \"list\"]'
      APP_ROLE_ID: key-manager
      APP_ROLE_POLICIES: '["allow_keys", "allow_secrets"]'
      POLICY_ID: allow_keys
      KVV2_MOUNT_PATH: secret
      KVV2_POLICY_ID: allow_secrets
    volumes:
      - token:/vault/token
      - ./scripts/vault-agent-init.sh:/usr/local/bin/init.sh
    entrypoint:
      - sh
      - -c
      - |

        cat <<EOF > /vault/config.hcl
          exit_after_auth = false

          vault {
            address = "http://vault:8200"
          }

          auto_auth {
            method "approle" {
              config = {
                role_id_file_path = "/vault/token/role"
                secret_id_file_path = "/vault/token/secret"
                remove_secret_id_file_after_reading = false
              }
            }

            sink "file" {
              config = {
                path = "/vault/token/.vault-token"
              }
            }
          }
        EOF

        until [ -f $${VAULT_IS_READY} ]; do
          echo "[AGENT] waiting for vault to be ready..."
          sleep 1
        done

        init.sh
        vault agent -config=/vault/config.hcl

networks:
  vault:
    driver: bridge

volumes:
  token:
    driver: local
  tls:
    driver: local