MinIO and KMS with Hashicorp Vault

docker-compose.yaml

@@ -153,6 +153,17 @@ services:
     - prometheus  
     restart: unless-stopped
 
+  myvault:
+    image: vault:1.7.3
+    expose:
+    - 3000
+    volumes:
+      - vault_file:/vault/file
+      - ./vault:/vault/config:rw
+    cap_add:
+      - IPC_LOCK
+    entrypoint: vault server -config=/vault/config/vault-config.json
+
 ## By default this config uses default local driver,
 ## For custom volumes replace with volume driver configuration.
 volumes:
@@ -168,3 +179,4 @@ volumes:
   certbot-var:
   grafana_data:
   prometheus_data:
+  vault_file:

nginx/conf.d/minio.conf.template

@@ -13,6 +13,10 @@ upstream console {
         server minio4:9001;
 }
 
+upstream vault_backend {
+	server myvault:8200;
+}
+
 server {
     listen       9000 ssl;
     listen  [::]:9000 ssl;
@@ -127,4 +131,20 @@ server {
 	proxy_pass http://grafana:3000/;
 	rewrite  ^/grafana/(.*)  /$1 break;
     }
+
+    location /ui/ {
+	proxy_pass "http://vault_backend/ui/";
+	proxy_set_header   Host $host;
+	proxy_set_header   X-Real-IP $remote_addr;
+	proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
+	proxy_set_header   X-Forwarded-Host $server_name;	
+    }
+
+    location /v1/ {
+	proxy_pass "http://vault_backend/v1/";
+	proxy_set_header   Host $host;
+	proxy_set_header   X-Real-IP $remote_addr;
+	proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
+	proxy_set_header   X-Forwarded-Host $server_name;
+    }
 }

vault/vault-config.json

@@ -0,0 +1,19 @@
+{
+  "api_addr": "https://127.0.0.1:8200",
+  "backend": {
+    "file": {
+      "path": "/vault/file"
+    }
+  },
+  "ui": true,
+  "default_lease_ttl": "168h",
+  "max_lease_ttl": "720h",
+  "disable_clustering": true,
+  "listener": {
+    "tcp": {
+      "address": "0.0.0.0:8200",
+      "tls_disable":  "true",
+      "proxy_protocol_behavior": "use_always"
+    }
+  }
+}