Add copy of TLS listener cert and key files

trevorr · Aug 19, 2016 · ab73936 · ab73936
1 parent 773e92e
commit ab73936
Show file tree

Hide file tree

Showing 2 changed files with 24 additions and 0 deletions.
diff --git a/defaults/main.yml b/defaults/main.yml
@@ -50,7 +50,9 @@ vault_backend_file_path: ''
 vault_listener_tcp_address: "127.0.0.1:8200"
 vault_listener_tcp_tls_disable: true
 vault_listener_tcp_tls_cert_file: ''
+vault_listener_tcp_tls_cert_local_file: ''
 vault_listener_tcp_tls_key_file: ''
+vault_listener_tcp_tls_key_local_file: ''
 vault_listener_tcp_tls_min_version: tls12
 
 vault_telemetry_statsite_address: ''

diff --git a/tasks/main.yml b/tasks/main.yml
@@ -118,6 +118,28 @@
   notify: restart vault
   tags: vault
 
+- name: Copy Vault TLS certificate
+  copy: >
+    dest="{{ vault_listener_tcp_tls_cert_file }}"
+    src="{{ vault_listener_tcp_tls_cert_local_file }}"
+    owner={{ vault_user }}
+    group={{ vault_group }}
+    mode=0644
+  notify: restart vault
+  when: vault_listener_tcp_tls_cert_file and vault_listener_tcp_tls_cert_local_file
+  tags: vault
+
+- name: Copy Vault TLS key
+  copy: >
+    dest="{{ vault_listener_tcp_tls_key_file }}"
+    src="{{ vault_listener_tcp_tls_key_local_file }}"
+    owner={{ vault_user }}
+    group={{ vault_group }}
+    mode=0600
+  notify: restart vault
+  when: vault_listener_tcp_tls_key_file and vault_listener_tcp_tls_key_local_file
+  tags: vault
+
 - name: Give vault access to mlock syscall
   capabilities: >
     path={{ vault_install_dir }}/vault