#!/bin/sh
  
set -eo pipefail

export VAULT_ADDR=https://{{ inventory_hostname }}:{{ vault_services.api.port | default('8200') }}
VAULT_STATUS=$(vault status -format=json)

if [ "$(echo ${VAULT_STATUS} | jq .is_self)" != "true" ]; then
  echo "We're not the active vault, exiting"
elif [ "$(echo ${VAULT_STATUS} | jq .sealed)" != "false" ]; then
  echo "Vault is sealed, exiting"
elif [ "$(echo ${VAULT_STATUS} | jq .initialized)" != "true" ]; then
  echo "Vault is not initialized yet, exiting"
else
  echo Updating Vault certificate to access Nomad API
  if [ -z "${VAULT_TOKEN}" -a -e /run/nomad/vault_config.env ]; then
    echo "Using VAULT_TOKEN from Nomad agent"
    export $(cat /run/nomad/vault_config.env)
  fi
  vault write {{ vault_agent_nomad.nomad_pki.cli.secret_path | default('nomad') }}/config/access \
    ca_cert="$(cat {{ nomad_root_dir }}/tls/ca.crt)" \
    client_cert="$(cat {{ nomad_root_dir }}/tls/cli.crt)" \
    client_key="$(cat {{ nomad_root_dir }}/tls/cli.key)"
fi