version: '3.8'

services:
  vault:
    environment:
      VAULT_LOG_LEVEL: "warn"
      VAULT_SKIP_VERIFY: "false"
    command: ["vault", "server", "-config=/vault/config/vault-prod.hcl"]
    ports:
      - "${VAULT_EXTERNAL_PORT:-8200}:8200"
    volumes:
      - vault-prod-data:/vault/data
      - ./vault-config:/vault/config:ro
      - ./tls:/vault/tls:ro
      - ./scripts:/vault/scripts:ro
    deploy:
      resources:
        limits:
          memory: 512M
          cpus: '0.5'
        reservations:
          memory: 256M
          cpus: '0.25'
    security_opt:
      - no-new-privileges:true
    read_only: true
    tmpfs:
      - /tmp:size=100M,noexec,nosuid,nodev

  vault-init:
    environment:
      VAULT_SKIP_VERIFY: "false"
      PRODUCTION_MODE: "true"
    command: ["/scripts/setup-prod.sh"]
    deploy:
      resources:
        limits:
          memory: 128M
          cpus: '0.1'

volumes:
  vault-prod-data:
    driver: local
    driver_opts:
      type: none
      o: bind
      device: ${VAULT_PROD_DATA_PATH:-./vault-prod-data}