version: '3.8'

services:
  vault:
    image: hashicorp/vault:1.15.6
    container_name: foxhunt-vault
    restart: unless-stopped
    ports:
      - "${VAULT_PORT:-8200}:8200"
    environment:
      VAULT_ADDR: "https://0.0.0.0:8200"
      VAULT_API_ADDR: "https://foxhunt-vault:8200"
      VAULT_CLUSTER_ADDR: "https://foxhunt-vault:8201"
      VAULT_UI: "true"
      VAULT_LOG_LEVEL: "info"
    volumes:
      - vault-data:/vault/data
      - ./vault-config:/vault/config:ro
      - ./tls:/vault/tls:ro
      - ./scripts:/vault/scripts:ro
    command: ["vault", "server", "-config=/vault/config"]
    cap_add:
      - IPC_LOCK
    networks:
      - vault-network
    healthcheck:
      test: ["CMD", "vault", "status"]
      interval: 10s
      timeout: 3s
      retries: 3
      start_period: 10s

  vault-init:
    image: hashicorp/vault:1.15.6
    container_name: foxhunt-vault-init
    depends_on:
      vault:
        condition: service_healthy
    environment:
      VAULT_ADDR: "https://foxhunt-vault:8200"
      VAULT_SKIP_VERIFY: "${VAULT_SKIP_VERIFY:-true}"
    volumes:
      - ./scripts:/scripts:ro
      - ./tls:/tls:ro
      - vault-init-data:/vault-init
    command: ["/scripts/init-vault.sh"]
    networks:
      - vault-network
    profiles:
      - init

volumes:
  vault-data:
    driver: local
    driver_opts:
      type: none
      o: bind
      device: ${VAULT_DATA_PATH:-./vault-data}
  vault-init-data:
    driver: local

networks:
  vault-network:
    driver: bridge
    ipam:
      driver: default
      config:
        - subnet: 172.20.0.0/16