mirror of
https://gitlab.sectorq.eu/jaydee/ansible.git
synced 2026-09-08 21:27:36 +02:00
136 lines
3.7 KiB
YAML
136 lines
3.7 KiB
YAML
---
|
|
- name: Setup router
|
|
become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
|
|
block:
|
|
- name: Ensure required packages are installed
|
|
ansible.builtin.apt:
|
|
name:
|
|
- gpg
|
|
- wget
|
|
- haproxy
|
|
state: present
|
|
update_cache: true
|
|
|
|
- name: Download HashiCorp GPG key
|
|
ansible.builtin.get_url:
|
|
url: https://apt.releases.hashicorp.com/gpg
|
|
dest: /tmp/hashicorp.asc
|
|
mode: '0644'
|
|
|
|
- name: Convert HashiCorp GPG key to keyring format
|
|
ansible.builtin.command:
|
|
cmd: >
|
|
gpg --dearmor
|
|
-o /usr/share/keyrings/hashicorp-archive-keyring.gpg
|
|
/tmp/hashicorp.asc
|
|
args:
|
|
creates: /usr/share/keyrings/hashicorp-archive-keyring.gpg
|
|
|
|
- name: Add HashiCorp APT repository
|
|
ansible.builtin.apt_repository:
|
|
repo: >
|
|
deb [arch={{ ansible_architecture == 'x86_64' | ternary('amd64', ansible_architecture) }}
|
|
signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg]
|
|
https://apt.releases.hashicorp.com
|
|
{{ ansible_distribution_release }}
|
|
main
|
|
filename: hashicorp
|
|
state: present
|
|
|
|
- name: Install Vault
|
|
ansible.builtin.apt:
|
|
name: vault
|
|
state: present
|
|
update_cache: true
|
|
|
|
- name: Create service for vault agent
|
|
ansible.builtin.copy:
|
|
dest: /etc/vault.d/vault.hcl
|
|
content: |
|
|
disable_mlock = true
|
|
|
|
storage "raft" {
|
|
path = "/opt/vault/raft"
|
|
node_id = "router.home.lan"
|
|
}
|
|
|
|
listener "tcp" {
|
|
address = "192.168.77.1:8200"
|
|
cluster_address = "192.168.77.1:8201"
|
|
tls_disable = 1
|
|
telemetry {
|
|
unauthenticated_metrics_access = true
|
|
}
|
|
}
|
|
|
|
api_addr = "http://192.168.77.1:8200"
|
|
cluster_addr = "http://192.168.77.1:8201"
|
|
ui = true
|
|
telemetry {
|
|
prometheus_retention_time = "24h"
|
|
disable_hostname = true
|
|
}
|
|
|
|
owner: vault
|
|
group: vault
|
|
mode: '0600'
|
|
|
|
- name: Create script for vault agent
|
|
ansible.builtin.copy:
|
|
dest: /opt/vault/scripts/unseal.sh
|
|
content: |
|
|
#!/usr/bin/env bash
|
|
export VAULT_ADDR="http://127.0.0.1:8200"
|
|
SEALED=$(vault status -format=json | jq -r .sealed)
|
|
|
|
if [ "$SEALED" = "true" ]; then
|
|
|
|
vault operator unseal "9990cbc17ae3b9282353ab3c6b5c5ce106d50958595189a8b8abbe924d76e2b591"
|
|
vault operator unseal "b8ef64c04bd6d2274a4fad34537d88a19ef02bbd1e858b28f6a9acf4693f7768e2"
|
|
vault operator unseal "9c735aa77d71f2c03d4b782bb6b6b3be0d0d44c99c7b72d5df77e4b1e15e7a4576"
|
|
else
|
|
echo "Vault already unsealed"
|
|
fi
|
|
|
|
|
|
owner: vault
|
|
group: vault
|
|
mode: '0700'
|
|
|
|
- name: Create service
|
|
ansible.builtin.copy:
|
|
dest: /etc/systemd/system/vault-unseal.service
|
|
content: |
|
|
[Unit]
|
|
Description=Vault Docker Auto Unseal
|
|
After=vault.service
|
|
Requires=vault.service
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
ExecStart=/opt/vault/scripts/unseal.sh
|
|
RemainAfterExit=yes
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
owner: root
|
|
group: root
|
|
mode: '0644'
|
|
|
|
- name: Configure haproxy
|
|
ansible.builtin.copy:
|
|
dest: /etc/haproxy/haproxy.cfg
|
|
src: haproxy.cfg
|
|
owner: root
|
|
group: root
|
|
mode: '0644'
|
|
|
|
- name: Enable and start services
|
|
ansible.builtin.systemd:
|
|
name: "{{ item }}"
|
|
enabled: yes
|
|
state: started
|
|
loop:
|
|
- vault
|
|
- vault-unseal
|
|
- haproxy |