services:
  app:
    image: ${DOCKER_REGISTRY:-}api-server:latest
    secrets:
    - vault_token
    environment:
      VAULT_TOKEN: /run/secrets/vault_token
    ports:
    - target: 8000
      published: 8002
      protocol: tcp
      mode: ingress
    deploy:
      replicas: 1
      placement:
        constraints:
        - node.role == manager

secrets:
  vault_token:
    external: true