build

roles/fix_router/tasks/main.yml

@@ -8,40 +8,51 @@
           - gpg
           - wget
           - haproxy
+          - ca-certificates
+          - unzip
         state: present
         update_cache: true
 
-    - name: Download HashiCorp GPG key
+    - name: Download Vault {{ vault_version }} ARM64
       ansible.builtin.get_url:
-        url: https://apt.releases.hashicorp.com/gpg
-        dest: /tmp/hashicorp.asc
-        mode: '0644'
+        url: "{{ vault_url }}"
+        dest: "{{ vault_download_dir }}/{{ vault_archive }}"
+        mode: "0644"
 
-    - name: Convert HashiCorp GPG key to keyring format
+    - name: Create Vault extraction directory
+      ansible.builtin.file:
+        path: "{{ vault_download_dir }}/vault-{{ vault_version }}"
+        state: directory
+        mode: "0755"
+
+
+    - name: Extract Vault
+      ansible.builtin.unarchive:
+        src: "{{ vault_download_dir }}/{{ vault_archive }}"
+        dest: "{{ vault_download_dir }}/vault-{{ vault_version }}"
+        remote_src: true
+        creates: "{{ vault_download_dir }}/vault-{{ vault_version }}/vault"
+
+    - name: Install Vault binary
+      ansible.builtin.copy:
+        src: "{{ vault_download_dir }}/vault-{{ vault_version }}/vault"
+        dest: "{{ vault_binary }}"
+        remote_src: true
+        owner: root
+        group: root
+        mode: "0755"
+
+    - name: Verify Vault installation
       ansible.builtin.command:
-        cmd: >
-          gpg --dearmor
-          -o /usr/share/keyrings/hashicorp-archive-keyring.gpg
-          /tmp/hashicorp.asc
-      args:
-        creates: /usr/share/keyrings/hashicorp-archive-keyring.gpg
+        cmd: "{{ vault_binary }} version"
+      register: vault_version_output
+      changed_when: false
+
+    - name: Display installed Vault version
+      ansible.builtin.debug:
+        var: vault_version_output.stdout
 
-    - name: Add HashiCorp APT repository
-      ansible.builtin.apt_repository:
-        repo: >
-          deb [arch={{ ansible_architecture == 'x86_64' | ternary('amd64', ansible_architecture) }}
-          signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg]
-          https://apt.releases.hashicorp.com
-          {{ ansible_distribution_release }}
-          main
-        filename: hashicorp
-        state: present
 
-    - name: Install Vault
-      ansible.builtin.apt:
-        name: vault
-        state: present
-        update_cache: true
 
     - name: Create service for vault agent
       ansible.builtin.copy:
@@ -80,7 +91,7 @@
         dest: /opt/vault/scripts/unseal.sh
         content: |
           #!/usr/bin/env bash
-          export VAULT_ADDR="http://127.0.0.1:8200"
+          export VAULT_ADDR="http://192.168.77.1:8200"
           SEALED=$(vault status -format=json | jq -r .sealed)
 
           if [ "$SEALED" = "true" ]; then
@@ -97,6 +108,36 @@
         group: vault
         mode: '0700'
 
+    - name: Install Vault systemd service
+      ansible.builtin.copy:
+        dest: /etc/systemd/system/vault.service
+        owner: root
+        group: root
+        mode: "0644"
+        content: |
+          [Unit]
+          Description=HashiCorp Vault
+          Documentation=https://developer.hashicorp.com/vault/docs
+          Requires=network-online.target
+          After=network-online.target
+
+          [Service]
+          User=vault
+          Group=vault
+
+          ExecStart=/usr/local/bin/vault server -config=/etc/vault.d/vault.hcl
+          ExecReload=/bin/kill --signal HUP $MAINPID
+
+          KillMode=process
+          KillSignal=SIGINT
+          Restart=on-failure
+          RestartSec=5
+
+          LimitNOFILE=65536
+
+          [Install]
+          WantedBy=multi-user.target
+
     - name: Create service
       ansible.builtin.copy:
         dest: /etc/systemd/system/vault-unseal.service
@@ -126,10 +167,11 @@
         mode: '0644'
       
     - name: Enable and start services
-      ansible.builtin.systemd:
+      ansible.builtin.systemd_service:
         name: "{{ item }}"
-        enabled: yes
+        enabled: true
         state: started
+        daemon_reload: true
       loop:
         - vault
         - vault-unseal