ansible/roles/vault-unseal/tasks/main.yml

- name: Cert gen
  become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
  vars:
    vault_address: "http://127.0.0.1:8200"
    vault_unseal_dir: "/opt/vault/scripts"
    vault_unseal_script: "/opt/vault/scripts/unseal.sh"

  block:
    - name: Include vault
      ansible.builtin.include_vars:
        file: jaydee.yml

    - name: Install jq on linux
      ansible.builtin.package:
        name: jq
        state: present

    - name: Create vault script directory
      ansible.builtin.file:
        path: "{{ vault_unseal_dir }}"
        state: directory
        owner: root
        group: root
        mode: "0700"

    - name: Deploy unseal script
      ansible.builtin.copy:
        dest: "{{ vault_unseal_script }}"
        owner: root
        group: root
        mode: "0700"
        content: |
          #!/usr/bin/env bash

          export VAULT_ADDR="{{ vault_address }}"

          while true; do
              SEALED=$(vault status -format=json 2>/dev/null | jq -r '.sealed')

              case "$SEALED" in
                  false)
                      echo "Vault already unsealed"
                      exit 0
                      ;;

                  true)
                      echo "Vault is sealed, unsealing..."

                      vault operator unseal "{{ vault_unseal_1 }}"
                      vault operator unseal "{{ vault_unseal_2 }}"
                      vault operator unseal "{{ vault_unseal_3 }}"

                      sleep 2
                      ;;

                  *)
                      echo "Vault unavailable, retrying..."
                      sleep 5
                      ;;
              esac
          done
    - name: Deploy systemd service
      ansible.builtin.copy:
        dest: /etc/systemd/system/vault-unseal.service
        owner: root
        group: root
        mode: "0644"
        content: |
          [Unit]
          Description=Vault Docker Auto Unseal
          After=docker.service
          Requires=docker.service
          PartOf=vault.service
          [Service]
          Type=oneshot
          ExecStart={{ vault_unseal_script }}
          RemainAfterExit=yes

          [Install]
          WantedBy=multi-user.target
      notify:
        - Reload systemd

    - name: Enable vault-unseal service
      ansible.builtin.systemd:
        name: vault-unseal.service
        enabled: true

    - name: Start vault-unseal service
      ansible.builtin.systemd:
        name: vault-unseal.service
        state: started