#
# Cookbook:: irrigate-vault
# Recipe:: proxy
#
# Copyright:: 2023, All Rights Reserved.

include_recipe 'irrigate-vault::default'

directory '/etc/systemd/system/vault.service.d'

cookbook_file '/etc/systemd/system/vault.service.d/override.conf' do
  source 'vault_proxy_systemd_override.conf'
end

directory File.dirname(node['vault']['proxy']['config']['auto_auth']['method']['config']['role_id_file_path']) do
  recursive true
  owner node['vault']['user']
  group node['vault']['group']
  mode '700'
end

directory File.dirname(node['vault']['proxy']['config']['auto_auth']['method']['config']['secret_id_file_path']) do
  recursive true
  owner node['vault']['user']
  group node['vault']['group']
  mode '700'
end

credentials = data_bag_item('secrets', node['vault']['proxy']['auto_auth_credentials_data_bag_name'])

file node['vault']['proxy']['config']['auto_auth']['method']['config']['role_id_file_path'] do
  content credentials['role_id']
  owner node['vault']['user']
  group node['vault']['group']
  mode '600'
  sensitive true
end

file node['vault']['proxy']['config']['auto_auth']['method']['config']['secret_id_file_path'] do
  content credentials['secret_id']
  owner node['vault']['user']
  group node['vault']['group']
  mode '600'
  sensitive true
end

template '/etc/vault.d/vault.hcl' do
  source 'vault_proxy_config.hcl.erb'
  owner node['vault']['user']
  group node['vault']['group']
  mode '640'
  variables(
    config: node['vault']['proxy']['config']
  )
  notifies :reload, 'service[vault]', :delayed
end

service 'vault' do
  action %i(enable start)
  supports reload: true
end