tbeyer567

/var/log/vault/audit.log {
  rotate 30
  daily
  # Do not execute rotate if the log file is empty.
  notifempty
  missingok
  compress
  # Set compress on next rotate cycl to prevent entry loss when performing compression.
  delaycompress
  postrotate

tbeyer567

- name: Create systemd overrides directory
  ansible.builtin.file:
    path: /etc/systemd/system/vault.service.d
    state: directory
    owner: root
    group: root
    mode: '0755'
    
- name: Create systemd overrides file
  ansible.builtin.copy:

tbeyer567

- hosts: all
  become: true
  remote_user: 
  roles:
     - ansible-role-vault

tbeyer567

# Enable userpass auth method

resource "vault_auth_backend" "userpass" {
  type = "userpass"
}

resource "vault_generic_endpoint" "admin" {
  depends_on           = [vault_auth_backend.userpass]
  path                 = "auth/userpass/users/admin"
  ignore_absent_fields = true

tbeyer567

path "engineering/*" {
  capabilities = ["create", "read", "update", "delete", "list"
}

path "support/*" {
  capabilities = ["deny"]
}

tbeyer567

path "engineering/*" {
  capabilities = ["create", "read", "update", "delete", "list"]
}