build

roles/vault_ssh_keys/tasks/main.yml

@@ -1,30 +1,57 @@
 - name: Setup vault SSH keys
   become: "{{ 'no' if inventory_hostname in ['sectorq.cloud', 'nas.home.lan'] else 'yes' }}"
   block:
-    
-    - name: Include vault
-      ansible.builtin.include_vars:
-        file: init.yml
-
-    - name: Install required dependencies
-      ansible.builtin.dnf:
+    - name: Facts
+      ansible.builtin.setup:
+      when: ansible_facts.architecture is not defined
+    - name: Install dependencies
+      apt:
         name:
-          - dnf-plugins-core
-          - curl
+          - wget
+          - unzip
+          - gnupg
+          - python3-debian
+        state: present
+        update_cache: yes
+
+    - name: Download HashiCorp GPG key
+      ansible.builtin.get_url:
+        url: https://apt.releases.hashicorp.com/gpg
+        dest: /tmp/hashicorp.gpg
+        mode: '0644'
+
+    - name: Dearmor HashiCorp GPG key
+      ansible.builtin.command:
+        cmd: gpg --dearmor -o /usr/share/keyrings/hashicorp-archive-keyring.gpg /tmp/hashicorp.gpg
+      args:
+        creates: /usr/share/keyrings/hashicorp-archive-keyring.gpg
+
+    - name: Read os-release
+      ansible.builtin.slurp:
+        src: /etc/os-release
+      register: os_release
+
+    - name: Extract UBUNTU_CODENAME
+      ansible.builtin.set_fact:
+        ubuntu_codename: "{{ (os_release.content | b64decode).split('\n')
+          | select('match', '^UBUNTU_CODENAME=')
+          | map('regex_replace', '^UBUNTU_CODENAME=', '')
+          | first }}"
+
+    - name: Add HashiCorp APT repository
+      ansible.builtin.apt_repository:
+        repo: >-
+          deb [arch={{ ansible_architecture }} signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg]
+          https://apt.releases.hashicorp.com {{ ubuntu_codename }} main
+        filename: hashicorp
         state: present
 
-    - name: Add HashiCorp repository
-      ansible.builtin.get_url:
-        url: https://rpm.releases.hashicorp.com/RHEL/hashicorp.repo
-        dest: /etc/yum.repos.d/hashicorp.repo
-        mode: "0644"
-
-    - name: Clean DNF cache
-      ansible.builtin.command: dnf clean all
-      changed_when: false
+    - name: Update apt cache
+      ansible.builtin.apt:
+        update_cache: yes
 
     - name: Install Vault
-      ansible.builtin.dnf:
+      apt:
         name: vault
         state: present
         update_cache: yes
@@ -85,9 +112,13 @@
           }
 
           auto_auth {
-            method "token_file" {
+            method "approle" {
+              mount_path = "auth/approle"
+
               config = {
-                token_file_path = "/etc/vault-agent/token"
+                role_id_file_path   = "/etc/vault-agent/role_id"
+                secret_id_file_path = "/etc/vault-agent/secret_id"
+                remove_secret_id_file_after_reading = false
               }
             }
 
@@ -98,6 +129,7 @@
             }
           }
 
+
           template {
             destination = "/home/jd/.ssh/id_ed25519-cert.pub"
             perms = "0644"
@@ -113,13 +145,15 @@
         group: root
         mode: '0644'
 
-    - name: Create file with token for vault agent
+    - name: Create secret id file
       copy:
-        dest: /etc/vault-agent/token
-        content: "{{ vault_sshcert_token }}"
-        owner: root
-        group: root
-        mode: '0600'
+        dest: /etc/vault-agent/secret_id
+        content: "{{ vault_secret_id }}"
+        
+    - name: Create role id file
+      copy:
+        dest: /etc/vault-agent/role_id
+        content: "{{ vault_role_id }}"
 
     - name: Create service for vault agent
       copy: