build

2026-09-09 05:37:35 +02:00 · 2026-05-11 10:43:10 +02:00
parent 5414961737
commit dba340e7e2
8 changed files with 187 additions and 0 deletions
@@ -0,0 +1,92 @@
+- name: Cert gen
+  become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
+  vars:
+    vault_address: "http://127.0.0.1:8200"
+    vault_unseal_dir: "/opt/vault/scripts"
+    vault_unseal_script: "/opt/vault/scripts/unseal.sh"
+
+  block:
+    - name: Include vault
+      ansible.builtin.include_vars:
+        file: jaydee.yml
+
+    - name: Install jq on linux
+      ansible.builtin.package:
+        name: jq
+        state: present
+
+    - name: Create vault script directory
+      ansible.builtin.file:
+        path: "{{ vault_unseal_dir }}"
+        state: directory
+        owner: root
+        group: root
+        mode: "0700"
+
+    - name: Deploy unseal script
+      ansible.builtin.copy:
+        dest: "{{ vault_unseal_script }}"
+        owner: root
+        group: root
+        mode: "0700"
+        content: |
+          #!/usr/bin/env bash
+
+          export VAULT_ADDR="{{ vault_address }}"
+
+          while true; do
+              SEALED=$(vault status -format=json 2>/dev/null | jq -r '.sealed')
+
+              case "$SEALED" in
+                  false)
+                      echo "Vault already unsealed"
+                      exit 0
+                      ;;
+
+                  true)
+                      echo "Vault is sealed, unsealing..."
+
+                      vault operator unseal "{{ vault_unseal_1 }}"
+                      vault operator unseal "{{ vault_unseal_2 }}"
+                      vault operator unseal "{{ vault_unseal_3 }}"
+
+                      sleep 2
+                      ;;
+
+                  *)
+                      echo "Vault unavailable, retrying..."
+                      sleep 5
+                      ;;
+              esac
+          done
+    - name: Deploy systemd service
+      ansible.builtin.copy:
+        dest: /etc/systemd/system/vault-unseal.service
+        owner: root
+        group: root
+        mode: "0644"
+        content: |
+          [Unit]
+          Description=Vault Docker Auto Unseal
+          After=docker.service
+          Requires=docker.service
+
+          [Service]
+          Type=oneshot
+          ExecStart={{ vault_unseal_script }}
+          RemainAfterExit=yes
+
+          [Install]
+          WantedBy=multi-user.target
+      notify:
+        - Reload systemd
+
+    - name: Enable vault-unseal service
+      ansible.builtin.systemd:
+        name: vault-unseal.service
+        enabled: true
+
+    - name: Start vault-unseal service
+      ansible.builtin.systemd:
+        name: vault-unseal.service
+        state: started