---
# hashistack deployment playbook
- name: "Deploy"
  hosts: all
  strategy: linear
  gather_facts: true
  become: true
  tasks:
    - name: "Debug"
      ansible.builtin.debug:
        msg: "{{ hashi_vault_configuration.listener }}"

    - name: "Import variables"
      ansible.builtin.import_tasks:
        file: tasks/load_vars.yml

    - name: "Vault"
      when:
        - enable_vault | bool
        - "'vault_servers' in group_names"
      tags:
        - vault
      block:
        - name: "Include ednxzu.hashicorp_vault"
          ansible.builtin.include_role:
            name: ednxzu.hashistack.hashicorp_vault

        - name: "Initialize vault cluster"  # noqa: run-once[task]
          ednxzu.hashistack.vault_init:
            api_url: "{{ hashi_vault_configuration['api_addr'] }}"
            key_shares: 3
            key_threshold: 2
          run_once: true
          retries: 5
          delay: 5
          delegate_to: "{{ groups['vault_servers'] | first }}"
          register: _vault_init_secret
          until: not _vault_init_secret.failed

        - name: "Write vault configuration to file"  # noqa: run-once[task] no-handler
          ansible.builtin.copy:
            content: "{{ _vault_init_secret.state | to_nice_yaml}}"
            dest: "{{ sub_configuration_directories.vault_servers }}/vault_config"
            mode: '0644'
          when: _vault_init_secret.changed
          run_once: true
          delegate_to: localhost

        - name: "Load vault cluster variables necessary for unseal operation"
          ansible.builtin.include_vars:
            file: "{{ sub_configuration_directories.vault_servers }}/vault_config"
            name: _vault_cluster_config

        - name: "Unseal the bootstrap node"  # noqa: run-once[task] no-handler
          ednxzu.hashistack.vault_unseal:
            api_url: "{{ hashi_vault_configuration['api_addr'] }}"
            key_shares: "{{ _vault_cluster_config['keys'] }}"
            max_retries: "{{ (_vault_cluster_config['keys'] | length) - 1 }}"
          run_once: true
          delegate_to: "{{ groups['vault_servers'] | first }}"
          when: _vault_init_secret.changed

        - name: "Unseal all vault nodes"
          ednxzu.hashistack.vault_unseal:
            api_url: "{{ hashi_vault_configuration['api_addr'] }}"
            key_shares: "{{ _vault_cluster_config['keys'] }}"
            max_retries: "{{ (_vault_cluster_config['keys'] | length) - 1 }}"
          retries: 5
          delay: 5
          register: _unseal_status
          until: not _unseal_status.failed