Update to 2022-08-31 13:00

roles/vault/tasks/archive_post.yml

@@ -0,0 +1,15 @@
+---
+
+- name: Compress previous version
+  command: tar cf {{ vault_root_dir }}/archives/{{ vault_current_version }}.tar.zst --use-compress-program=zstd ./
+  args:
+    chdir: "{{ vault_root_dir }}/archives/{{ vault_current_version }}"
+    warn: False
+  environment:
+    ZSTD_CLEVEL: 10
+  tags: vault
+
+- name: Remove archive dir
+  file: path={{ vault_root_dir }}/archives/{{ vault_current_version }} state=absent
+  tags: vault
+

roles/vault/tasks/archive_pre.yml

@@ -0,0 +1,10 @@
+---
+
+- name: Create the archive dir
+  file: path={{ vault_root_dir }}/archives/{{ vault_current_version }} state=directory
+  tags: vault
+
+- name: Backup previous version
+  copy: src={{ vault_root_dir }}/bin/vault dest={{ vault_root_dir }}/archives/{{ vault_current_version }}/ remote_src=True
+  tags: vault
+

roles/vault/tasks/cleanup.yml

@@ -0,0 +1,8 @@
+---
+
+- name: Remove tmp and obsolete files
+  file: path={{ item }} state=absent
+  loop:
+    - "{{ vault_root_dir }}/tmp/vault_{{ vault_version }}_linux_amd64.zip"
+    - "{{ vault_root_dir }}/tmp/vault"
+  tags: vault

roles/vault/tasks/conf.yml

@@ -0,0 +1,20 @@
+---
+
+- name: Generate self-signed certificate
+  import_tasks: ../includes/create_selfsigned_cert.yml
+  vars:
+    cert_path: "{{ vault_root_dir }}/tls/vault.crt"
+    cert_key_path: "{{ vault_root_dir }}/tls/vault.key"
+    cert_key_group: "{{ vault_user }}"
+    cert_key_mode: 640
+  tags: vault
+
+- name: Deploy vault configuration
+  template:
+    src: vault.hcl.j2
+    dest: "{{ vault_root_dir }}/etc/vault.hcl"
+    owner: "{{ vault_user }}"
+    group: "{{ vault_user }}"
+    mode: 0400
+  notify: restart vault
+  tags: vault

roles/vault/tasks/directories.yml

@@ -0,0 +1,42 @@
+---
+
+- name: Create needed directories
+  file: path={{ vault_root_dir }}/{{ item.dir }} state=directory owner={{ item.owner | default(omit) }} group={{ item.group | default(omit) }} mode={{ item.mode | default(omit) }} recurse={{ item.recurse | default(omit) }}
+  loop:
+    - dir: /
+      owner: root
+      group: root
+      mode: 755
+    - dir: archives
+      owner: root
+      group: root
+      mode: 700
+    - dir: backup
+      owner: root
+      group: root
+      mode: 700
+    - dir: meta
+      owner: root
+      group: root
+      mode: 700
+    - dir: bin
+    - dir: plugins
+    - dir: tmp
+      owner: "{{ vault_user }}"
+      group: "{{ vault_user }}"
+      mode: u=rwX,g=-,o=-
+      recurse: True
+    - dir: data
+      owner: "{{ vault_user }}"
+      group: "{{ vault_user }}"
+      mode: u=rwX,g=-,o=-
+      recurse: True
+    - dir: etc
+      owner: "{{ vault_user }}"
+      group: "{{ vault_user }}"
+      mode: 700
+    - dir: tls
+      owner: root
+      group: "{{ vault_user }}"
+      mode: 750
+  tags: vault

roles/vault/tasks/facts.yml

@@ -0,0 +1,12 @@
+---
+
+- name: Detect installed version
+  block:
+    - import_tasks: ../includes/webapps_set_install_mode.yml
+      vars:
+        - root_dir: "{{ vault_root_dir }}"
+        - version: "{{ vault_version }}"
+    - set_fact: vault_install_mode={{ install_mode | default('none') }}
+    - set_fact: vault_current_version={{ current_version | default('') }}
+  tags: vault
+

roles/vault/tasks/install.yml

@@ -0,0 +1,67 @@
+---
+
+- name: Install needed tools
+  package:
+    name:
+      - tar
+      - zstd
+      - unzip
+  tags: vault
+
+- when: vault_install_mode != 'none'
+  block:
+    - name: Download vault
+      get_url:
+        url: "{{ vault_archive_url }}"
+        dest: "{{ vault_root_dir }}/tmp"
+        checksum: sha256:{{ vault_archive_sha256 }}
+
+    - name: Extract the archive
+      unarchive:
+        src: "{{ vault_root_dir }}/tmp/vault_{{ vault_version }}_linux_amd64.zip"
+        dest: "{{ vault_root_dir }}/tmp"
+        remote_src: True
+
+    - name: Install vault binary
+      copy:
+        src: "{{ vault_root_dir }}/tmp/vault"
+        dest: "{{ vault_root_dir }}/bin/vault"
+        remote_src: True
+        mode: 755
+
+    - name: Link in /usr/local/bin
+      file: src={{ vault_root_dir }}/bin/vault dest=/usr/local/bin/vault state=link force=True
+
+  tags: vault
+
+- name: Install bash completion support
+  copy:
+    content: |
+      complete -C {{ vault_root_dir }}/bin/vault vault
+    dest: /etc/bash_completion.d/vault
+    mode: 755
+  tags: vault
+
+- name: Deploy systemd service unit
+  template: src=vault.service.j2 dest=/etc/systemd/system/vault.service
+  register: vault_unit
+  notify: restart vault
+  tags: vault
+
+- name: Reload systemd
+  systemd: daemon_reload=True
+  when: vault_unit.changed
+  tags: vault
+
+- name: Install dehydrated hook
+  template: src=dehydrated_hook.j2 dest=/etc/dehydrated/hooks_deploy_cert.d/vault mode=755
+  tags: vault
+
+- name: Install profile script
+  copy:
+    content: |
+      #!/bin/sh
+      export VAULT_ADDR={{ vault_conf.api_addr }}
+    dest: /etc/profile.d/vault.sh
+    mode: 0755
+  tags: vault

roles/vault/tasks/iptables.yml

@@ -0,0 +1,10 @@
+---
+
+- name: Handle vault ports in the firewall
+  iptables_raw:
+    name: vault_port_{{ item }}
+    state: "{{ (vault_services[item].src_ip | length > 0) | ternary('present', 'absent') }}"
+    rules: |
+      -A INPUT -m state --state NEW -p tcp --dport {{ vault_services[item].port }} -j ACCEPT
+  loop: "{{ vault_services.keys() | list }}"
+  tags: firewall,vault

roles/vault/tasks/main.yml

@@ -0,0 +1,38 @@
+---
+
+- include_tasks: user.yml
+  tags: always
+
+- include_tasks: directories.yml
+  tags: always
+
+- include_tasks: facts.yml
+  tags: always
+
+- include_tasks: archive_pre.yml
+  when: vault_install_mode | default('none') == 'upgrade'
+  tags: always
+
+- include_tasks: install.yml
+  tags: always
+
+- include_tasks: conf.yml
+  tags: always
+
+- include_tasks: iptables.yml
+  when: iptables_manage | default(True)
+  tags: always
+
+- include_tasks: services.yml
+  tags: always
+
+- include_tasks: write_version.yml
+  tags: always
+
+- include_tasks: archive_post.yml
+  when: vault_install_mode | default('none') == 'upgrade'
+  tags: always
+
+- include_tasks: cleanup.yml
+  tags: always
+

roles/vault/tasks/services.yml

@@ -0,0 +1,6 @@
+---
+
+- name: Start and enable vault service
+  service: name=vault state=started enabled=True
+  register: vault_service_started
+  tags: vault

roles/vault/tasks/user.yml

@@ -0,0 +1,9 @@
+---
+
+- name: Create vault user
+  user:
+    name: "{{ vault_user }}"
+    home: "{{ vault_root_dir }}"
+    system: True
+    shell: /sbin/nologin
+  tags: vault

roles/vault/tasks/write_version.yml

@@ -0,0 +1,5 @@
+---
+
+- name: Write installed version
+  copy: content={{ vault_version }} dest={{ vault_root_dir }}/meta/ansible_version
+  tags: vault