Add multiple services support for certificate deployment

justfile

@@ -33,6 +33,7 @@ vault username:
 # Setup a virtualenv and install dependencies
 [group('tooling')]
 venv:
+    #!/usr/bin/env bash 
     [[ -d .venv ]] || (python -m venv .venv --prompt rezoleo-ansible-playbooks && {{venv_bin}}/pip install -r requirements.txt)
 
 # Run ansible-lint

roles/vault_agent/defaults/main.yml

@@ -1,3 +1,17 @@
+# Location of approle files
 vault_agent_working_directory: /root/vault_agent_certificates
 
+# Version of vault agent
 vault_agent_vault_version: 1.18.2
+
+# Location where the certificate will be stored
+vault_agent_certificate_directory: "/var/lib/vault_agent_certificates"
+
+# Name of the group that is allowed to read certificate
+vault_agent_group_name: "vault-certs"
+
+# Command to execute after certificate update
+# vault_agent_service_reload_command:
+#   - systemctl
+#   - restart
+#   - mon_super_service

roles/vault_agent/tasks/main.yml

@@ -89,13 +89,17 @@
     owner: root
     group: root
 
+- name: Create read-acces group
+  ansible.builtin.group:
+    name: "{{ vault_agent_group_name }}"
+
 - name: Create directory for certificates
   ansible.builtin.file:
     state: directory
     dest: "{{ vault_agent_certificate_directory }}"
     mode: '0755'
     owner: root
-    group: root
+    group: "{{ vault_agent_group_name }}"
 
 - name: Start vault-agent-certificates service
   ansible.builtin.systemd:

roles/vault_agent/templates/retrieving_cert.tmpl.j2

@@ -1,8 +1,8 @@
 {{with secret "secret/certificat-web"}}
-{{ index .Data.data "privkey.pem" | writeToFile "<<vault_agent_certificate_directory>>/privkey.pem" "" "" "0400" }}
-{{ index .Data.data "chain.pem" | writeToFile "<<vault_agent_certificate_directory>>/chain.pem" "" "" "0400" }}
-{{ index .Data.data "cert.pem" | writeToFile "<<vault_agent_certificate_directory>>/cert.pem" "" "" "0400" }}
-{{ index .Data.data "fullchain.pem" | writeToFile "<<vault_agent_certificate_directory>>/fullchain.pem" "" "" "0400" }}
+{{ index .Data.data "privkey.pem" | writeToFile "<<vault_agent_certificate_directory>>/privkey.pem" "" "<<vault_agent_group_name>>" "0440" }}
+{{ index .Data.data "chain.pem" | writeToFile "<<vault_agent_certificate_directory>>/chain.pem" "" "<<vault_agent_group_name>>" "0440" }}
+{{ index .Data.data "cert.pem" | writeToFile "<<vault_agent_certificate_directory>>/cert.pem" "" "<<vault_agent_group_name>>" "0440" }}
+{{ index .Data.data "fullchain.pem" | writeToFile "<<vault_agent_certificate_directory>>/fullchain.pem" "" "<<vault_agent_group_name>>" "0440" }}
 {{ index .Data.data "privkey.pem" }}
 {{ index .Data.data "chain.pem" }}
 {{ index .Data.data "cert.pem" }}