I try to run Vault with docker-compose on Virtual machine ubuntu 20.04 ( ip : 192.168.56.9 ). Without the https, already works fine, but when I try to put vault in https with self-signed certificat from openssl, it doesn't works.
Here my configurations :
docker-compose.yml :
version: '3.6'
services:
vault:
build:
context: ./vault
dockerfile: Dockerfile
ports:
- 8200:8200
volumes:
- ./vault/config:/vault/config
- ./vault/policies:/vault/policies
- ./vault/data:/vault/data
- ./vault/logs:/vault/logs
- ./vault/volume_test/:/vault/volume_test
environment:
- VAULT_ADDR=http://192.168.56.9:8200
command: server -config=/vault/config/vault-config.conf
cap_add:
- IPC_LOCK
Dockerfile :
# base image
FROM alpine:3.7
# set vault version
ENV VAULT_VERSION 0.10.3
# create a new directory
RUN mkdir /vault
# download dependencies
RUN apk --no-cache add \
bash \
ca-certificates \
wget
# download and set up vault
RUN wget --quiet --output-document=/tmp/vault.zip https://releases.hashicorp.com/vault/${VAULT_VERSION}/vault_${VAULT_VERSION}_linux_amd64.zip && \
unzip /tmp/vault.zip -d /vault && \
rm -f /tmp/vault.zip && \
chmod +x /vault
# update PATH
ENV PATH="PATH=$PATH:$PWD/vault"
# add the config file
COPY ./config/vault-config.conf /vault/config/vault-config.conf
# expose port 8200
EXPOSE 8200
# run vault
ENTRYPOINT ["vault"]
My vault-config.conf :
backend "file" {
path = "vault/data"
}
listener "tcp" {
address = "0.0.0.0:8200"
tls_disable = false
tls_cert_file = "/home/xxx/Vault-Docker/domain.crt"
tls_key_file = "/home/xxx/Vault-Docker/domain.key"
}
#api_addr = "http://192.168.56.9:8200"
disable_mlock = true
ui = true
How I create my .crt and my .key :
Create a cert.conf file in /home/xxx/Vault-Docker/ :
[req]
default_bits = 4096
default_md = sha256
distinguished_name = req_distinguished_name
x509_extensions = v3_req
prompt = no
[req_distinguished_name]
C = FR
ST = VA
L = SomeCity
O = MyCompany
OU = MyDivision
CN = 192.168.56.9
[v3_req]
keyUsage = keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names
[alt_names]
IP.1 = 192.168.56.9
And excute in /home/xxx/Vault-Docker/ :
openssl req -nodes -x509 -days 365 -keyout domain.key -out domain.crt -config cert.conf
But when I run :
docker-compose up -d --build
Then :
docker logs vault-docker_vault_1
The output is :
Error initializing listener of type tcp: error loading TLS cert: open /home/xxx/Vault-Docker/domain.crt: no such file or directory
Someone to tell me where is my error ?
Thanks a lot !