services:
  app:
    image: ${DOCKER_REGISTRY:-}api-server:latest
    secrets:
    - vault_passwod
    environment:
      VAULT_PASSWOD: /run/secrets/vault_passwod
    expose:
    - 8002
    deploy:
      replicas: 1
      placement:
        constraints:
        - node.role == manager

secrets:
  vault_passwod:
    external: true