From 157005ae7b152c04f596301a5e8eefa1d0b28517 Mon Sep 17 00:00:00 2001
From: Ian Fijolek <ian@iamthefij.com>
Date: Mon, 25 Jul 2022 15:51:41 -0700
Subject: [PATCH] Get mysql root from vault

---
 nomad/databases/mysql.nomad | 24 ++++++++++++++++++++----
 1 file changed, 20 insertions(+), 4 deletions(-)

diff --git a/nomad/databases/mysql.nomad b/nomad/databases/mysql.nomad
index 92b3b6b..8e27fc6 100644
--- a/nomad/databases/mysql.nomad
+++ b/nomad/databases/mysql.nomad
@@ -56,6 +56,18 @@ job "mysql-server" {
     task "mysql-server" {
       driver = "docker"
 
+      config {
+        image = "mysql:8"
+        ports = ["db"]
+      }
+
+      vault {
+        policies = [
+          "access-tables",
+          "nomad-task",
+        ]
+      }
+
       volume_mount {
         volume = "mysql-data"
         destination = "/var/lib/mysql"
@@ -63,14 +75,18 @@ job "mysql-server" {
       }
 
       env = {
-        "MYSQL_ROOT_PASSWORD" = "supersecretpassword"
         # Allow connections from any host
         "MYSQL_ROOT_HOST" = "%"
       }
 
-      config {
-        image = "mysql:8"
-        ports = ["db"]
+      template {
+        data = <<EOH
+{{ with secret "kv/data/mysql" }}
+MYSQL_ROOT_PASSWORD={{ Data.data.root_password }}
+{{ end }}
+        EOH
+        destination = "secrets/db.env"
+        env = true
       }
 
       resources {