unkin/puppet-prod
2
0
Fork 0
Code Issues 10 Pull Requests Actions Packages Projects Releases Wiki Activity

feat: vault mlock (#266)

Browse Source 
- enable mlock by default
- disable mlock on lxd/incus nodes (lxc doesnt support it)

Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/266
This commit is contained in:
Ben Vincent 2025-04-26 22:43:20 +10:00
parent 1e3ce0ec1c
commit 9359b8902e
2 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
hieradata/common.yaml
View File

@ -180,7 +180,7 @@ vault::manage_repo: false
vault::bin_dir: /usr/bin vault::bin_dir: /usr/bin
vault::manage_service_file: true vault::manage_service_file: true
vault::manage_config_dir: true vault::manage_config_dir: true
vault::disable_mlock: true vault::disable_mlock: false
profiles::dns::master::basedir: '/var/named/sources' profiles::dns::master::basedir: '/var/named/sources'
profiles::dns::base::ns_role: 'roles::infra::dns::resolver' profiles::dns::base::ns_role: 'roles::infra::dns::resolver'

3
hieradata/virtual/lxc.yaml
View File

@ -2,3 +2,6 @@
profiles::packages::include: profiles::packages::include:
chrony: chrony:
ensure: absent ensure: absent
# disable mlock for vault nodes on lxd/incus
vault::disable_mlock: true