---

# A full restart will require unsealing again and should be done rarely.  If
# all that's changing is the config file, prefer a reload instead.
- name: restart vault
  listen: restart vault
  become: yes
  service:
    name: vault
    state: restarted

- name: reload vault
  listen: reload vault
  become: yes
  service:
    name: vault
    state: reloaded
