---

- name: allow vault to mlock
  # This allows Vault to prevent itself from being paged out to swap, which is
  # useful from a security perspective as we don't have encrypted swap.  See
  # mlock(2) for more details.
  become: yes
  capabilities:
    capability: cap_ipc_lock=+ep
    path: /usr/bin/vault

- name: create vault group
  become: yes
  group:
    name: vault
    system: yes

- name: create vault user
  become: yes
  user:
    name: vault
    system: yes
    group: vault

- name: Create vault configuration directory
  become: yes
  file:
    path: /etc/vault/
    state: directory
    owner: root
    group: root
    mode: u=rwx,g=rx,o=rx

- name: install vault configuration
  become: yes
  copy:
    src: templates/vault.hcl
    dest: /etc/vault/
    owner: root
    group: root
    mode: u=rw,g=r,o=r
  notify:
    - reload vault

- name: Install SSL certificate
  become: yes
  copy:
    src: templates/zooxlabs_wildcard.crt
    dest: /etc/vault/zooxlabs_wildcard.crt
    owner: root
    group: root
    mode: u=rw,g=r,o=r
  notify:
    - reload vault

- name: Install SSL private key
  become: yes
  copy:
    content: "{{ lookup('hashi_vault', 'secret=secret/cert/zooxlabs_wildcard').private_key }}"
    dest: /etc/vault/zooxlabs_wildcard.key
    owner: root
    group: root
    mode: u=rw,g=r,o=r
  notify:
    - reload vault

- name: install vault systemd service file
  become: yes
  copy:
    src: templates/vault.service
    dest: /etc/systemd/system/
    owner: root
    group: root
    mode: u=rw,g=r,o=r
  notify:
    - restart vault

- name: create vault log directory
  become: yes
  file:
    path: /var/log/vault
    state: directory
    owner: vault
    group: vault
    mode: u=rwx,g=rwx,o=rx

- name: start vault
  become: yes
  service:
    name: vault
    state: started
