- name: Setup vault
  become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
  block:
    - name: Install dependencies
      apt:
        name:
          - wget
          - unzip
          - gnupg
        state: present
        update_cache: yes

    - name: Add HashiCorp GPG key
      apt_key:
        url: https://apt.releases.hashicorp.com/gpg
        state: present

    - name: Add HashiCorp repo
      apt_repository:
        repo: "deb [arch=amd64] https://apt.releases.hashicorp.com {{ ansible_distribution_release }} main"
        state: present

    - name: Install Vault
      apt:
        name: vault
        state: present
        update_cache: yes

    # - name: Create Vault user data dir
    #   file:
    #     path: /opt/vault/data
    #     state: directory
    #     owner: vault
    #     group: vault
    #     mode: "0750"

    # - name: Deploy Vault config
    #   template:
    #     src: templates/vault.hcl.j2
    #     dest: /etc/vault.d/vault.hcl
    #     owner: vault
    #     group: vault
    #     mode: "0640"

    # - name: Enable Vault service
    #   systemd:
    #     name: vault
    #     enabled: yes
    #     state: started

    - name: Setup vault token
      ansible.builtin.lineinfile:
        path: /
        regexp: "^export VAULT_TOKEN=*"
        line: "export VAULT_TOKEN={{ vault_token }}"

    - name: Setup vault address
      ansible.builtin.lineinfile:
        path: /
        regexp: "^export VAULT_ADDR=*"
        line: "export VAULT_ADDR={{ vault_addr }}"