---

- name: retrieve installed vault version
  shell: test -x /usr/bin/vault && echo $(vault version | sed 's/Vault v//')
  # Any failure to gather version information from Vault just indicates that we
  # need to install the current version, so failures here aren't actually
  # failures, and displaying them as such (even with ignore_errors: yes) just
  # confuses people who watch the output.
  failed_when: false
  changed_when: false
  register: _installed_vault_version

- block:
  - name: download vault
    get_url:
      url: https://releases.hashicorp.com/vault/{{ vault_version }}/vault_{{ vault_version }}_linux_amd64.zip
      dest: /tmp/
      # Don't redownload the file if we already have it.
      force: no
      validate_certs: yes
      checksum: sha256:{{ vault_checksum }}

  - name: install unzip
    become: yes
    apt:
      name: unzip
      cache_valid_time: "{{ apt_cache_valid_time }}"

  - name: install vault
    unarchive:
      src: /tmp/vault_{{ vault_version }}_linux_amd64.zip
      dest: /usr/bin/
      copy: no
      owner: root
      group: root
      mode: '755'
    become: yes
  when: _installed_vault_version.stdout != vault_version
