Skip to content

Vault addr

vault_addr

Container-side vault addressing — single source of truth.

Two transports reach the vault from inside a task container:

  • Socket mode (default, preferred): the host's vault socket is bind-mounted into the container at CONTAINER_VAULT_SOCKET. Clients that can speak HTTP-over-UNIX (gh, claude) connect directly; everyone else goes through an in-container socat bridge that exposes the vault as plain TCP on localhost:LOOPBACK_VAULT_PORT.

  • TCP mode (legacy): the vault's token broker listens on a host TCP port (host.containers.internal:<broker_port>). Socket-only clients reach it via a local socat bridge that presents a Unix socket at LOOPBACK_BRIDGE_SOCKET.

These paths and port numbers have to agree across the python builders, the shell bridge script, and the doctor probes — define them here so every layer imports the same value.

CONTAINER_VAULT_SOCKET = _CONTAINER_VAULT_SOCKET module-attribute

Host vault socket as seen inside the container (socket mode only).

LOOPBACK_BRIDGE_SOCKET = '/tmp/terok-vault.sock' module-attribute

Local socat-created socket that fronts the broker in TCP mode.

LOOPBACK_VAULT_PORT = 9419 module-attribute

TCP port the in-container loopback bridge listens on (socket mode).

Sits next to the gate bridge on 9418; picked once, hardcoded everywhere.

VAULT_LOOPBACK_PORT_ENV = 'TEROK_VAULT_LOOPBACK_PORT' module-attribute

Env var name the bridge script reads to find the loopback port.

LOOPBACK_VAULT_TLS_PORT = 9420 module-attribute

TCP port the in-container TLS bridge listens on, in front of the loopback.

VAULT_TLS_PORT_ENV = 'TEROK_VAULT_TLS_PORT' module-attribute

Env var name the bridge script reads to find the TLS port.

VAULT_TLS_CERT = '/tmp/.terok/vault-tls/cert.pem' module-attribute

The TLS bridge's self-signed certificate, made in the container by the bridge script.

A client that should trust the TLS bridge is pointed at this file; nothing else trusts it.