job "vault-cluster-exec" {
  datacenters = ["dc1"]
  type = "service"

  group "vault-master" {
    count = 1

    constraint {
      attribute = "${node.unique.name}"
      value = "kr-master"
    }

    network {
      port "api" {
        static = 8200
      }
      port "cluster" {
        static = 8201
      }
    }

    task "vault" {
      driver = "exec"

      config {
        command = "vault"
        args = [
          "server",
          "-config=/opt/nomad/data/vault/config/vault.hcl"
        ]
      }

      template {
        data = <<EOH
storage "consul" {
  address = "127.0.0.1:8500"
  path    = "vault/"
}

listener "tcp" {
  address     = "0.0.0.0:8200"
  tls_disable = 1  # 生产环境应启用TLS
}

api_addr = "http://{{ env "NOMAD_IP_api" }}:8200"
cluster_addr = "http://{{ env "NOMAD_IP_cluster" }}:8201"

ui = true
disable_mlock = true

# 添加更多配置来解决权限问题
disable_sealwrap = true
disable_cache = false
EOH
        destination = "/opt/nomad/data/vault/config/vault.hcl"
      }

      resources {
        cpu    = 500
        memory = 1024
      }

      service {
        name = "vault"
        port = "api"
        
        check {
          name     = "vault-health"
          type     = "http"
          path     = "/v1/sys/health"
          interval = "10s"
          timeout  = "2s"
        }
      }
    }
  }

  group "vault-ash3c" {
    count = 1

    constraint {
      attribute = "${node.unique.name}"
      value = "us-ash3c"
    }

    network {
      port "api" {
        static = 8200
      }
      port "cluster" {
        static = 8201
      }
    }

    task "vault" {
      driver = "exec"

      config {
        command = "vault"
        args = [
          "server",
          "-config=/opt/nomad/data/vault/config/vault.hcl"
        ]
      }

      template {
        data = <<EOH
storage "consul" {
  address = "127.0.0.1:8500"
  path    = "vault/"
}

listener "tcp" {
  address     = "0.0.0.0:8200"
  tls_disable = 1  # 生产环境应启用TLS
}

api_addr = "http://{{ env "NOMAD_IP_api" }}:8200"
cluster_addr = "http://{{ env "NOMAD_IP_cluster" }}:8201"

ui = true
disable_mlock = true

# 添加更多配置来解决权限问题
disable_sealwrap = true
disable_cache = false
EOH
        destination = "/opt/nomad/data/vault/config/vault.hcl"
      }

      resources {
        cpu    = 500
        memory = 1024
      }

      service {
        name = "vault"
        port = "api"
        
        check {
          name     = "vault-health"
          type     = "http"
          path     = "/v1/sys/health"
          interval = "10s"
          timeout  = "2s"
        }
      }
    }
  }

  group "vault-warden" {
    count = 1

    constraint {
      attribute = "${node.unique.name}"
      value = "bj-warden"
    }

    network {
      port "api" {
        static = 8200
      }
      port "cluster" {
        static = 8201
      }
    }

    task "vault" {
      driver = "exec"

      config {
        command = "vault"
        args = [
          "server",
          "-config=/opt/nomad/data/vault/config/vault.hcl"
        ]
      }

      template {
        data = <<EOH
storage "consul" {
  address = "127.0.0.1:8500"
  path    = "vault/"
}

listener "tcp" {
  address     = "0.0.0.0:8200"
  tls_disable = 1  # 生产环境应启用TLS
}

api_addr = "http://{{ env "NOMAD_IP_api" }}:8200"
cluster_addr = "http://{{ env "NOMAD_IP_cluster" }}:8201"

ui = true
disable_mlock = true

# 添加更多配置来解决权限问题
disable_sealwrap = true
disable_cache = false
EOH
        destination = "/opt/nomad/data/vault/config/vault.hcl"
      }

      resources {
        cpu    = 500
        memory = 1024
      }

      service {
        name = "vault"
        port = "api"
        
        check {
          name     = "vault-health"
          type     = "http"
          path     = "/v1/sys/health"
          interval = "10s"
          timeout  = "2s"
        }
      }
    }
  }
}