---
- name: Setup router
  become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
  block:
    - name: Ensure required packages are installed
      ansible.builtin.apt:
        name:
          - gpg
          - wget
          - haproxy
        state: present
        update_cache: true

    - name: Download HashiCorp GPG key
      ansible.builtin.get_url:
        url: https://apt.releases.hashicorp.com/gpg
        dest: /tmp/hashicorp.asc
        mode: '0644'

    - name: Convert HashiCorp GPG key to keyring format
      ansible.builtin.command:
        cmd: >
          gpg --dearmor
          -o /usr/share/keyrings/hashicorp-archive-keyring.gpg
          /tmp/hashicorp.asc
      args:
        creates: /usr/share/keyrings/hashicorp-archive-keyring.gpg

    - name: Add HashiCorp APT repository
      ansible.builtin.apt_repository:
        repo: >
          deb [arch={{ ansible_architecture == 'x86_64' | ternary('amd64', ansible_architecture) }}
          signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg]
          https://apt.releases.hashicorp.com
          {{ ansible_distribution_release }}
          main
        filename: hashicorp
        state: present

    - name: Install Vault
      ansible.builtin.apt:
        name: vault
        state: present
        update_cache: true

    - name: Create service for vault agent
      ansible.builtin.copy:
        dest: /etc/vault.d/vault.hcl
        content: |
          disable_mlock = true

          storage "raft" {
            path    = "/opt/vault/raft"
            node_id = "router.home.lan"
          }

          listener "tcp" {
            address     = "192.168.77.1:8200"
            cluster_address = "192.168.77.1:8201"
            tls_disable = 1
            telemetry {
              unauthenticated_metrics_access = true
            }
          }

          api_addr     = "http://192.168.77.1:8200"
          cluster_addr = "http://192.168.77.1:8201"
          ui = true
          telemetry {
            prometheus_retention_time = "24h"
            disable_hostname = true
          }

        owner: vault
        group: vault
        mode: '0600'

    - name: Create script for vault agent
      ansible.builtin.copy:
        dest: /opt/vault/scripts/unseal.sh
        content: |
          #!/usr/bin/env bash
          export VAULT_ADDR="http://127.0.0.1:8200"
          SEALED=$(vault status -format=json | jq -r .sealed)

          if [ "$SEALED" = "true" ]; then

            vault operator unseal "9990cbc17ae3b9282353ab3c6b5c5ce106d50958595189a8b8abbe924d76e2b591"
            vault operator unseal "b8ef64c04bd6d2274a4fad34537d88a19ef02bbd1e858b28f6a9acf4693f7768e2"
            vault operator unseal "9c735aa77d71f2c03d4b782bb6b6b3be0d0d44c99c7b72d5df77e4b1e15e7a4576"
          else
            echo "Vault already unsealed"
          fi


        owner: vault
        group: vault
        mode: '0700'

    - name: Create service
      ansible.builtin.copy:
        dest: /etc/systemd/system/vault-unseal.service
        content: |
          [Unit]
          Description=Vault Docker Auto Unseal
          After=vault.service
          Requires=vault.service

          [Service]
          Type=oneshot
          ExecStart=/opt/vault/scripts/unseal.sh
          RemainAfterExit=yes

          [Install]
          WantedBy=multi-user.target
        owner: root
        group: root
        mode: '0644'

    - name: Configure haproxy
      ansible.builtin.copy:
        dest: /etc/haproxy/haproxy.cfg
        src: haproxy.cfg
        owner: root
        group: root
        mode: '0644'
      
    - name: Enable and start services
      ansible.builtin.systemd:
        name: "{{ item }}"
        enabled: yes
        state: started
      loop:
        - vault
        - vault-unseal
        - haproxy