vault-agent.hcl.j2

pid_file = "/vault-agent/agent.pid"

vault {
  address = "{{ vault_server }}"
  tls_skip_verify = true
}

auto_auth {
  method "approle" {
    config = {
      role_id_file_path                   = "/vault-agent/agent-role-id"
      secret_id_file_path                 = "/vault-agent/agent-secret-id"
      remove_secret_id_file_after_reading = false
    }
  }
  sink "file" {
    config = {
      path = "/vault-agent/agent-token"
    }
  }
}

cache {
  use_auto_auth_token = true
}

listener "tcp" {
  address     = "127.0.0.1:8100"
  tls_disable = true
}

template {
  source      = "/vault-agent/vault-agentKey.ctmpl"
  destination = "/vault-agent/{{ ansible_fqdn }}.key"
  perms       = 0600
}

template {
  source      = "/vault-agent/vault-agentCert.ctmpl"
  destination = "/vault-agent/{{ ansible_fqdn }}.crt"
  perms       = 0644
  command     = /vault-agent/agent-script.sh"
}