mgmt/nomad-jobs/vault-single/vault-cluster.nomad

job "vault-cluster" {
  datacenters = ["dc1"]
  type        = "service"

  group "vault-warden" {
    count = 1

    volume "vault-storage" {
      type      = "host"
      read_only = false
      source    = "vault-storage"
    }

    constraint {
      attribute = "${node.unique.name}"
      operator  = "="
      value     = "warden"
    }

    network {
      port "http" {
        static = 8200
        to     = 8200
      }
      port "cluster" {
        static = 8201
        to     = 8201
      }
    }

    task "vault" {
      driver = "exec"

      volume_mount {
        volume      = "vault-storage"
        destination = "/opt/nomad/data/vault-storage"
        read_only   = false
      }

      resources {
        cpu    = 500
        memory = 1024
      }

      env {
        VAULT_ADDR = "http://127.0.0.1:8200"
        VAULT_CLUSTER_ADDR = "http://127.0.0.1:8201"
      }

      # Vault集群配置
      template {
        data = <<EOF
ui = true
disable_mlock = true

# 使用Consul作为存储后端
storage "consul" {
  address = "127.0.0.1:8500"
  path    = "vault/"
  
  # 集群配置
  datacenter = "dc1"
  service = "vault"
  service_tags = "vault-server"
  
  # 会话配置
  session_ttl = "15s"
  lock_wait_time = "15s"
}

# HTTP监听器
listener "tcp" {
  address     = "0.0.0.0:8200"
  tls_disable = 1
}

# 集群监听器
listener "tcp" {
  address = "0.0.0.0:8201"
  purpose = "cluster"
}

# API地址 - 使用Tailscale网络
api_addr = "http://{{ env "NOMAD_IP_http" }}:8200"

# 集群地址 - 使用Tailscale网络
cluster_addr = "http://{{ env "NOMAD_IP_cluster" }}:8201"

# 集群名称
cluster_name = "vault-cluster"

# 日志配置
log_level = "INFO"
EOF
        destination = "local/vault.hcl"
        perms       = "644"
      }

      config {
        command = "vault"
        args = [
          "server",
          "-config=/local/vault.hcl"
        ]
      }

      restart {
        attempts = 2
        interval = "30m"
        delay    = "15s"
        mode     = "fail"
      }
    }

    update {
      max_parallel     = 1
      health_check     = "checks"
      min_healthy_time = "10s"
      healthy_deadline = "5m"
      progress_deadline = "10m"
      auto_revert      = true
      canary           = 0
    }

    migrate {
      max_parallel     = 1
      health_check     = "checks"
      min_healthy_time = "10s"
      healthy_deadline = "5m"
    }
  }

  group "vault-ch4" {
    count = 1

    volume "vault-storage" {
      type      = "host"
      read_only = false
      source    = "vault-storage"
    }

    constraint {
      attribute = "${node.unique.name}"
      operator  = "="
      value     = "ch4"
    }

    network {
      port "http" {
        static = 8200
        to     = 8200
      }
      port "cluster" {
        static = 8201
        to     = 8201
      }
    }

    task "vault" {
      driver = "exec"

      volume_mount {
        volume      = "vault-storage"
        destination = "/opt/nomad/data/vault-storage"
        read_only   = false
      }

      resources {
        cpu    = 500
        memory = 1024
      }

      env {
        VAULT_ADDR = "http://127.0.0.1:8200"
        VAULT_CLUSTER_ADDR = "http://127.0.0.1:8201"
      }

      # Vault集群配置
      template {
        data = <<EOF
ui = true
disable_mlock = true

# 使用Consul作为存储后端
storage "consul" {
  address = "127.0.0.1:8500"
  path    = "vault/"
  
  # 集群配置
  datacenter = "dc1"
  service = "vault"
  service_tags = "vault-server"
  
  # 会话配置
  session_ttl = "15s"
  lock_wait_time = "15s"
}

# HTTP监听器
listener "tcp" {
  address     = "0.0.0.0:8200"
  tls_disable = 1
}

# 集群监听器
listener "tcp" {
  address = "0.0.0.0:8201"
  purpose = "cluster"
}

# API地址 - 使用Tailscale网络
api_addr = "http://{{ env "NOMAD_IP_http" }}:8200"

# 集群地址 - 使用Tailscale网络
cluster_addr = "http://{{ env "NOMAD_IP_cluster" }}:8201"

# 集群名称
cluster_name = "vault-cluster"

# 日志配置
log_level = "INFO"
EOF
        destination = "local/vault.hcl"
        perms       = "644"
      }

      config {
        command = "vault"
        args = [
          "server",
          "-config=/local/vault.hcl"
        ]
      }

      restart {
        attempts = 2
        interval = "30m"
        delay    = "15s"
        mode     = "fail"
      }
    }

    update {
      max_parallel     = 1
      health_check     = "checks"
      min_healthy_time = "10s"
      healthy_deadline = "5m"
      progress_deadline = "10m"
      auto_revert      = true
      canary           = 0
    }

    migrate {
      max_parallel     = 1
      health_check     = "checks"
      min_healthy_time = "10s"
      healthy_deadline = "5m"
    }
  }

  group "vault-ash3c" {
    count = 1

    volume "vault-storage" {
      type      = "host"
      read_only = false
      source    = "vault-storage"
    }

    constraint {
      attribute = "${node.unique.name}"
      operator  = "="
      value     = "ash3c"
    }

    network {
      port "http" {
        static = 8200
        to     = 8200
      }
      port "cluster" {
        static = 8201
        to     = 8201
      }
    }

    task "vault" {
      driver = "exec"

      volume_mount {
        volume      = "vault-storage"
        destination = "/opt/nomad/data/vault-storage"
        read_only   = false
      }

      resources {
        cpu    = 500
        memory = 1024
      }

      env {
        VAULT_ADDR = "http://127.0.0.1:8200"
        VAULT_CLUSTER_ADDR = "http://127.0.0.1:8201"
      }

      # Vault集群配置
      template {
        data = <<EOF
ui = true
disable_mlock = true

# 使用Consul作为存储后端
storage "consul" {
  address = "127.0.0.1:8500"
  path    = "vault/"
  
  # 集群配置
  datacenter = "dc1"
  service = "vault"
  service_tags = "vault-server"
  
  # 会话配置
  session_ttl = "15s"
  lock_wait_time = "15s"
}

# HTTP监听器
listener "tcp" {
  address     = "0.0.0.0:8200"
  tls_disable = 1
}

# 集群监听器
listener "tcp" {
  address = "0.0.0.0:8201"
  purpose = "cluster"
}

# API地址 - 使用Tailscale网络
api_addr = "http://{{ env "NOMAD_IP_http" }}:8200"

# 集群地址 - 使用Tailscale网络
cluster_addr = "http://{{ env "NOMAD_IP_cluster" }}:8201"

# 集群名称
cluster_name = "vault-cluster"

# 日志配置
log_level = "INFO"
EOF
        destination = "local/vault.hcl"
        perms       = "644"
      }

      config {
        command = "vault"
        args = [
          "server",
          "-config=/local/vault.hcl"
        ]
      }

      restart {
        attempts = 2
        interval = "30m"
        delay    = "15s"
        mode     = "fail"
      }
    }

    update {
      max_parallel     = 1
      health_check     = "checks"
      min_healthy_time = "10s"
      healthy_deadline = "5m"
      progress_deadline = "10m"
      auto_revert      = true
      canary           = 0
    }

    migrate {
      max_parallel     = 1
      health_check     = "checks"
      min_healthy_time = "10s"
      healthy_deadline = "5m"
    }
  }
}