7ecdf7a606
Добавлена установка времени жизни токена (TTL). Добавлено соответствие ограничения длины пароля и длины текста для шифрования. Добавлена подготовка токена к расшифровке (ограничение длины, удаление пробельных символов).
86 lines
2.5 KiB
YAML
86 lines
2.5 KiB
YAML
version: '3'
|
|
|
|
services:
|
|
vault-wrap:
|
|
# $IMAGE_PATH и $RELEASE_VERSION определены в .gitlab-ci.yml
|
|
image: $IMAGE_PATH/vault-wrap:$RELEASE_VERSION
|
|
container_name: vault-wrap
|
|
environment:
|
|
- ACTION_ADDRESS=${ACTION_ADDRESS:-https://secret.example.ru}
|
|
- VAULT_ADDRESS=${VAULT_ADDRESS}
|
|
- VAULT_TOKEN=${WRAP_TOKEN}
|
|
- LISTEN_PORT=8080
|
|
- TLS_KEY_FILE=${TLS_KEY_FILE}
|
|
- TLS_CERT_FILE=${TLS_CERT_FILE}
|
|
- TZ=Europe/Moscow
|
|
- MAX_TEXT_LENGTH=${MAX_TEXT_LENGTH:-100}
|
|
- TOKEN_TTL=${TOKEN_TTL:-3600}
|
|
restart: always
|
|
# ports:
|
|
# - 1234:8080
|
|
build:
|
|
context: .
|
|
volumes:
|
|
- vault-wrap-log:/var/log/vault-wrap
|
|
- vault-wrap-conf:/usr/local/share/vault-wrap
|
|
logging:
|
|
# driver: "syslog"
|
|
options:
|
|
max-size: "10m"
|
|
max-file: "5"
|
|
labels:
|
|
- "traefik.enable=true"
|
|
- "traefik.http.routers.secret.rule=Host(`secret.example.ru`)"
|
|
- "traefik.http.services.secret.loadbalancer.server.port=8080"
|
|
- "traefik.docker.network=reverse-proxy"
|
|
- "traefik.http.routers.secret.tls=true"
|
|
- "traefik.http.services.secret.loadbalancer.server.scheme=http"
|
|
networks:
|
|
- default
|
|
- vault-wrap
|
|
|
|
traefik:
|
|
image: traefik:v3.0
|
|
container_name: traefik
|
|
command:
|
|
# - --entrypoints.web.address=:80
|
|
# - --entrypoints.web-secure.address=:443
|
|
# - --providers.docker=true
|
|
- --providers.file.directory=/configuration/
|
|
- --providers.file.watch=true
|
|
volumes:
|
|
- traefik-dynamic-conf:/configuration/
|
|
- /home/gitlab-runner/traefik/traefik.yml:/traefik.yml:ro
|
|
- /var/run/docker.sock:/var/run/docker.sock:ro
|
|
- traefik-ssl:/ssl/:ro
|
|
ports:
|
|
- 80:80
|
|
# - 8080:8080
|
|
- 888:888
|
|
- 443:443
|
|
restart: always
|
|
networks:
|
|
- default
|
|
labels:
|
|
- "traefik.enable=true"
|
|
- "traefik.http.routers.traefik.entrypoints=https"
|
|
- "traefik.http.routers.traefik.rule=Host(`example.ru`)"
|
|
- "traefik.http.routers.traefik.tls=true"
|
|
# - "traefik.http.routers.traefik.tls.certresolver=letsEncrypt"
|
|
- "traefik.http.routers.traefik.service=api@internal"
|
|
- "traefik.http.services.traefik.loadbalancer.server.port=888"
|
|
- "traefik.http.services.traefik.loadbalancer.server.scheme=https"
|
|
|
|
networks:
|
|
default:
|
|
name: reverse-proxy
|
|
external: true
|
|
vault-wrap:
|
|
internal: true
|
|
|
|
volumes:
|
|
vault-wrap-log:
|
|
vault-wrap-conf:
|
|
traefik-dynamic-conf:
|
|
traefik-ssl:
|