aboutsummaryrefslogtreecommitdiffstats
path: root/fdio.infra.ansible/roles/vault/tasks/main.yaml
blob: 300cfdb363a350b185a1f50f80af47fd2f66754d (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
---
# file: roles/vault/tasks/main.yaml

- name: Inst - Update Package Cache (APT)
  apt:
    update_cache: true
    cache_valid_time: 3600
  when:
    - ansible_distribution|lower == 'ubuntu'
  tags:
    - vault-inst-prerequisites

- name: Inst - Prerequisites
  package:
    name: "{{ packages | flatten(levels=1) }}"
    state: latest
  tags:
    - vault-inst-prerequisites

- name: Conf - Add Vault Group
  group:
    name: "{{ vault_group }}"
    state: "{{ vault_user_state }}"
  tags:
    - vault-conf-user

- name: Conf - Add Vault user
  user:
    name: "{{ vault_user }}"
    group: "{{ vault_group }}"
    state: "{{ vault_group_state }}"
    system: true
  tags:
    - vault-conf-user

- name: Inst - Clean Vault
  file:
    path: "{{ vault_inst_dir }}/vault"
    state: "absent"
  tags:
    - vault-inst-package

- name: Inst - Download Vault
  get_url:
    url: "{{ vault_zip_url }}"
    dest: "{{ vault_inst_dir }}/{{ vault_pkg }}"
  tags:
    - vault-inst-package

- name: Inst - Unarchive Vault
  unarchive:
    src: "{{ vault_inst_dir }}/{{ vault_pkg }}"
    dest: "{{ vault_inst_dir }}/"
    creates: "{{ vault_inst_dir }}/vault"
    remote_src: true
  tags:
    - vault-inst-package

- name: Inst - Vault
  copy:
    src: "{{ vault_inst_dir }}/vault"
    dest: "{{ vault_bin_dir }}"
    owner: "{{ vault_user }}"
    group: "{{ vault_group }}"
    force: true
    mode: 0755
    remote_src: true
  tags:
    - vault-inst-package

- name: Inst - Check Vault mlock capability
  command: "setcap cap_ipc_lock=+ep {{ vault_bin_dir }}/vault"
  changed_when: false  # read-only task
  ignore_errors: true
  register: vault_mlock_capability
  tags:
    - vault-inst-package

- name: Inst - Enable non root mlock capability
  command: "setcap cap_ipc_lock=+ep {{ vault_bin_dir }}/vault"
  when: vault_mlock_capability is failed
  tags:
    - vault-inst-package

- name: Conf - Create directories
  file:
    dest: "{{ item }}"
    state: directory
    owner: "{{ vault_user }}"
    group: "{{ vault_group }}"
    mode: 0750
  with_items:
    - "{{ vault_data_dir }}"
    - "{{ vault_config_dir }}"
    - "{{ vault_ssl_dir }}"
  tags:
    - vault-conf

- name: Conf - Vault main configuration
  template:
    src: "{{ vault_main_configuration_template }}"
    dest: "{{ vault_main_config }}"
    owner: "{{ vault_user }}"
    group: "{{ vault_group }}"
    mode: 0400
  tags:
    - vault-conf

# - name: Conf - Copy Certificates And Keys
#   copy:
#     content: "{{ item.src }}"
#     dest: "{{ item.dest }}"
#     owner: "{{ vault_user }}"
#     group: "{{ vault_group }}"
#     mode: 0600
#   no_log: true
#   loop: "{{ vault_certificates | flatten(levels=1) }}"
#   tags:
#     - vault-conf

- name: Conf - System.d Script
  template:
    src: "vault_systemd.service.j2"
    dest: "/lib/systemd/system/vault.service"
    owner: "root"
    group: "root"
    mode: 0644
  notify:
    - "Restart Vault"
  tags:
    - vault-conf

- meta: flush_handlers