blob: a15e867d5f7d35de85f0f7ac9125f3d64eb97b09 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
|
---
- name: Container Setup
vars:
lxc_base: ansible-alpine3.11
lxc_name: vault
import_playbook: ../common/tasks/lxc.yml
- name: Installing Vault
hosts: vault
vars_files:
- ../variables.yml
tasks:
- name: Ensuring group exists
group:
name: "{{ vault_user }}"
state: present
- name: Creating user and making home directory
user:
system: yes
state: present
name: "{{ vault_user }}"
groups: "{{ vault_user }}"
home: "{{ vault_home }}"
- name: Installing the required dependencies
apk:
state: present
update_cache: yes
name:
- sudo
- supervisor
- libcap
- unzip
- block:
- name: Downloading and extracting application
unarchive:
src: "https://releases.hashicorp.com/vault/{{ vault_version }}/vault_{{ vault_version }}_linux_amd64.zip"
dest: "{{ vault_home }}"
remote_src: yes
- name: Creating data folder
file:
path: "{{ vault_home }}/data"
state: directory
mode: '0755'
- name: Copying config file
copy:
src: config.json
dest: "{{ vault_home }}"
mode: '0644'
register: vaultConfig
become: true
become_user: "{{ vault_user }}"
- name: Allowing application to call mlock
capabilities:
path: "{{ vault_home }}/vault"
capability: cap_ipc_lock=+ep
state: present
- name: Copying supervisord config file
copy:
src: supervisord.conf
dest: /etc/supervisord.conf
mode: '0644'
register: supervisorConfig
- name: Ensuring supervisord has been started and enabled
service:
name: supervisord
state: started
enabled: yes
- name: Waiting for supervisor to become active
wait_for:
port: 9100
- name: Restarting supervisord due to config change
service:
name: supervisord
state: restarted
when: supervisorConfig.changed
- name: Ensuring vault has been started
supervisorctl:
name: vault
state: started
- name: Waiting for application to become active
wait_for:
port: 8100
- name: Restarting vault due to config change
supervisorctl:
name: vault
state: restarted
when: vaultConfig.changed
|
