#
# Cookbook:: irrigate-vault
# Recipe:: server
#
# Copyright:: 2023, All Rights Reserved.

include_recipe 'irrigate-vault::default'

directory node['vault']['server']['config']['storage']['path'] do
  action :create
  owner node['vault']['user']
  group node['vault']['group']
  mode '700'
end

credentials = data_bag_item('secrets', node['vault']['server']['aws_credentials_data_bag_name'])

template '/etc/vault.d/vault.hcl' do
  source 'vault_server_config.hcl.erb'
  owner node['vault']['user']
  group node['vault']['group']
  mode '640'
  variables(
    config: node['vault']['server']['config'],
    credentials: credentials
  )
  sensitive true
  notifies :reload, 'service[vault]', :delayed
end

service 'vault' do
  action %i(enable start)
  supports reload: true
end