ansible/roles/fix_router/tasks/main.yml

---
- name: Setup router
  become: "{{ false if inventory_hostname == 'nas.home.lan' else true }}"
  block:
    - name: Ensure required packages are installed
      ansible.builtin.apt:
        name:
          - gpg
          - wget
          - haproxy
          - ca-certificates
          - unzip
        state: present
        update_cache: true

    - name: Download Vault {{ vault_version }} ARM64
      ansible.builtin.get_url:
        url: "{{ vault_url }}"
        dest: "{{ vault_download_dir }}/{{ vault_archive }}"
        mode: "0644"

    - name: Create Vault extraction directory
      ansible.builtin.file:
        path: "{{ vault_download_dir }}/vault-{{ vault_version }}"
        state: directory
        mode: "0755"


    - name: Extract Vault
      ansible.builtin.unarchive:
        src: "{{ vault_download_dir }}/{{ vault_archive }}"
        dest: "{{ vault_download_dir }}/vault-{{ vault_version }}"
        remote_src: true
        creates: "{{ vault_download_dir }}/vault-{{ vault_version }}/vault"

    - name: Install Vault binary
      ansible.builtin.copy:
        src: "{{ vault_download_dir }}/vault-{{ vault_version }}/vault"
        dest: "{{ vault_binary }}"
        remote_src: true
        owner: root
        group: root
        mode: "0755"

    - name: Verify Vault installation
      ansible.builtin.command:
        cmd: "{{ vault_binary }} version"
      register: vault_version_output
      changed_when: false

    - name: Display installed Vault version
      ansible.builtin.debug:
        var: vault_version_output.stdout



    - name: Create service for vault agent
      ansible.builtin.copy:
        dest: /etc/vault.d/vault.hcl
        content: |
          disable_mlock = true

          storage "raft" {
            path    = "/opt/vault/raft"
            node_id = "router.home.lan"
          }

          listener "tcp" {
            address     = "192.168.77.1:8200"
            cluster_address = "192.168.77.1:8201"
            tls_disable = 1
            telemetry {
              unauthenticated_metrics_access = true
            }
          }

          api_addr     = "http://192.168.77.1:8200"
          cluster_addr = "http://192.168.77.1:8201"
          ui = true
          telemetry {
            prometheus_retention_time = "24h"
            disable_hostname = true
          }

        owner: vault
        group: vault
        mode: '0600'

    - name: Create script for vault agent
      ansible.builtin.copy:
        dest: /opt/vault/scripts/unseal.sh
        content: |
          #!/usr/bin/env bash
          export VAULT_ADDR="http://192.168.77.1:8200"
          SEALED=$(vault status -format=json | jq -r .sealed)

          if [ "$SEALED" = "true" ]; then

            vault operator unseal "9990cbc17ae3b9282353ab3c6b5c5ce106d50958595189a8b8abbe924d76e2b591"
            vault operator unseal "b8ef64c04bd6d2274a4fad34537d88a19ef02bbd1e858b28f6a9acf4693f7768e2"
            vault operator unseal "9c735aa77d71f2c03d4b782bb6b6b3be0d0d44c99c7b72d5df77e4b1e15e7a4576"
          else
            echo "Vault already unsealed"
          fi


        owner: vault
        group: vault
        mode: '0700'

    - name: Install Vault systemd service
      ansible.builtin.copy:
        dest: /etc/systemd/system/vault.service
        owner: root
        group: root
        mode: "0644"
        content: |
          [Unit]
          Description=HashiCorp Vault
          Documentation=https://developer.hashicorp.com/vault/docs
          Requires=network-online.target
          After=network-online.target

          [Service]
          User=vault
          Group=vault

          ExecStart=/usr/local/bin/vault server -config=/etc/vault.d/vault.hcl
          ExecReload=/bin/kill --signal HUP $MAINPID

          KillMode=process
          KillSignal=SIGINT
          Restart=on-failure
          RestartSec=5

          LimitNOFILE=65536

          [Install]
          WantedBy=multi-user.target

    - name: Create service
      ansible.builtin.copy:
        dest: /etc/systemd/system/vault-unseal.service
        content: |
          [Unit]
          Description=Vault Docker Auto Unseal
          After=vault.service
          Requires=vault.service

          [Service]
          Type=oneshot
          ExecStart=/opt/vault/scripts/unseal.sh
          RemainAfterExit=yes

          [Install]
          WantedBy=multi-user.target
        owner: root
        group: root
        mode: '0644'

    - name: Configure haproxy
      ansible.builtin.copy:
        dest: /etc/haproxy/haproxy.cfg
        src: haproxy.cfg
        owner: root
        group: root
        mode: '0644'
      
    - name: Enable and start services
      ansible.builtin.systemd_service:
        name: "{{ item }}"
        enabled: true
        state: started
        daemon_reload: true
      loop:
        - vault
        - vault-unseal
        - haproxy