Update to 2022-09-08 18:00

roles/vault/tasks/install.yml

@@ -40,7 +40,7 @@
     content: |
       complete -C {{ vault_root_dir }}/bin/vault vault
     dest: /etc/bash_completion.d/vault
-    mode: 755
+    mode: 0644
   tags: vault
 
 - name: Deploy systemd service unit
@@ -52,13 +52,12 @@
 - name: Install consul-template unit
   template: src=consul-template-vault.service.j2 dest=/etc/systemd/system/consul-template-vault.service
   notify: restart consul-template-vault
-  when: vault_secrets.nomad.enabled
   register: vault_secrets_nomad_unit
   tags: vault
 
 - name: Reload systemd
   systemd: daemon_reload=True
-  when: vault_unit.changed or (vault_secrets_nomad_unit is defined and vault_secrets_nomad_unit.changed)
+  when: vault_unit.changed or vault_secrets_nomad_unit.changed
   tags: vault
 
 - name: Install dehydrated hook

roles/vault/tasks/iptables.yml

@@ -4,7 +4,6 @@
   iptables_raw:
     name: vault_port_{{ item }}
     state: "{{ (vault_services[item].src_ip | length > 0) | ternary('present', 'absent') }}"
-    rules: |
-      -A INPUT -m state --state NEW -p tcp --dport {{ vault_services[item].port }} -j ACCEPT
+    rules: "-A INPUT -m state --state NEW -p tcp --dport {{ vault_services[item].port }} -s {{ vault_services[item].src_ip | flatten | join(',') }} -j ACCEPT"
   loop: "{{ vault_services.keys() | list }}"
   tags: firewall,vault