Patrick de Ruiter
22d78bf85c
All checks were successful
Code Quality & Security Scan / TFLint (push) Successful in 24s
Code Quality & Security Scan / Tfsec Security Scan (push) Successful in 30s
Code Quality & Security Scan / Checkov Security Scan (push) Successful in 44s
Code Quality & Security Scan / Terraform Validate (push) Successful in 43s
Code Quality & Security Scan / SonarQube Trigger (push) Successful in 47s
- Remove ansible/ from .gitignore - Add vault_agent role (copied from terraform-vsphere-infra) - Add vault_agent-playbook.yml for deployment - Include ansible collections (cloud.terraform, ansible.posix, etc.) - Archive consul_template role as consul_template-legacy The ansible directory contains the vault-agent deployment automation that replaces the legacy consul-template approach.
43 lines
1.2 KiB
Django/Jinja
43 lines
1.2 KiB
Django/Jinja
pid_file = "{{ vault_agent_data_dir }}/pidfile"
|
|
|
|
vault {
|
|
address = "{{ vault_address }}"
|
|
tls_skip_verify = {{ vault_tls_skip_verify | lower }}
|
|
}
|
|
|
|
auto_auth {
|
|
method "approle" {
|
|
mount_path = "auth/approle"
|
|
config = {
|
|
role_id_file_path = "{{ vault_agent_config_dir }}/role_id"
|
|
secret_id_file_path = "{{ vault_agent_config_dir }}/secret_id"
|
|
}
|
|
}
|
|
|
|
sink "file" {
|
|
config = {
|
|
path = "{{ vault_agent_data_dir }}/vault-token"
|
|
}
|
|
}
|
|
}
|
|
|
|
template {
|
|
source = "{{ vault_agent_config_dir }}/certificate.tpl"
|
|
destination = "{{ ssl_certs_dir }}/{{ short_hostname | default(inventory_hostname) }}.crt"
|
|
perms = 0644
|
|
command = "systemctl is-active nginx >/dev/null 2>&1 && systemctl reload nginx || true"
|
|
}
|
|
|
|
template {
|
|
source = "{{ vault_agent_config_dir }}/chain_pem.tpl"
|
|
destination = "{{ ssl_private_dir }}/le-chaincert.pem"
|
|
perms = 0600
|
|
command = "systemctl is-active nginx >/dev/null 2>&1 && systemctl reload nginx || true"
|
|
}
|
|
|
|
template {
|
|
source = "{{ vault_agent_config_dir }}/private_key.tpl"
|
|
destination = "{{ ssl_private_dir }}/{{ short_hostname | default(inventory_hostname) }}.key"
|
|
perms = 0600
|
|
command = "systemctl is-active nginx >/dev/null 2>&1 && systemctl reload nginx || true"
|
|
} |