mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 19:01:54 +00:00
30 lines
1.7 KiB
YAML
30 lines
1.7 KiB
YAML
---
|
|
- name: "🗄 Ensure the KV v2 secrets engine is mounted at '{{ OPENBAO_KV_MOUNT }}'"
|
|
ansible.builtin.shell: > # nocheck: container-exec-resolver runtime-resolved CID, delegated to the hosting node
|
|
container exec {{ OPENBAO_LOCAL_CID | quote }}
|
|
sh -c 'bao secrets list -format=json | grep -q "\"{{ OPENBAO_KV_MOUNT }}/\"" ||
|
|
{ bao secrets enable -path={{ OPENBAO_KV_MOUNT | quote }} -version=2 kv && echo OPENBAO_CHANGED; }'
|
|
register: openbao_kv_mount
|
|
changed_when: "'OPENBAO_CHANGED' in openbao_kv_mount.stdout"
|
|
|
|
- name: "📜 Write the human RBAC policies"
|
|
ansible.builtin.shell: > # nocheck: container-exec-resolver runtime-resolved CID, delegated to the hosting node
|
|
container exec {{ OPENBAO_LOCAL_CID | quote }}
|
|
sh -c 'set -e; before=$(bao policy read {{ item | quote }} 2>/dev/null || true);
|
|
bao policy write {{ item | quote }} {{ OPENBAO_POLICY_DIR_DOCKER }}/{{ item }}.hcl >/dev/null;
|
|
after=$(bao policy read {{ item | quote }});
|
|
[ "$before" = "$after" ] || echo OPENBAO_CHANGED'
|
|
loop: "{{ OPENBAO_RBAC_ROLES }}"
|
|
register: openbao_policy_write
|
|
changed_when: "'OPENBAO_CHANGED' in openbao_policy_write.stdout"
|
|
|
|
- name: "📜 Refresh the ansible-admin policy"
|
|
ansible.builtin.shell: > # nocheck: container-exec-resolver runtime-resolved CID, delegated to the hosting node
|
|
container exec {{ OPENBAO_LOCAL_CID | quote }}
|
|
sh -c 'set -e; before=$(bao policy read ansible-admin 2>/dev/null || true);
|
|
bao policy write ansible-admin {{ OPENBAO_POLICY_DIR_DOCKER }}/ansible-admin.hcl >/dev/null;
|
|
after=$(bao policy read ansible-admin);
|
|
[ "$before" = "$after" ] || echo OPENBAO_CHANGED'
|
|
register: openbao_admin_policy_write
|
|
changed_when: "'OPENBAO_CHANGED' in openbao_admin_policy_write.stdout"
|