services:
  app:
    image: ${DOCKER_REGISTRY:-}api-server:latest
    secrets:
    - vault_token
    environment:
      VAULT_TOKEN: /run/secrets/vault_token
    expose:
    - 8002
    deploy:
      replicas: 1
      placement:
        constraints:
        - node.role == manager

secrets:
  vault_token:
    external: true