Configure Ansible Vault integration with HashiCorp Vault for secrets management

#!/usr/bin/env bash
set -euo pipefail

# ---------------------------------------------------------------------------
# Configure HashiCorp Vault server + Ansible Vault integration bootstrap
# Usage: ./install-vault-ansible.sh <vault-fqdn> [ansible-user]
# ---------------------------------------------------------------------------

RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m'

log()  { echo -e "${GREEN}[$1/$2]${NC} $3"; }
warn() { echo -e "${YELLOW}WARN:${NC} $1"; }
err()  { echo -e "${RED}ERROR:${NC} $1" >&2; }

usage() {
    echo "Usage: $0 <vault-fqdn> [ansible-user]"
    echo "  vault-fqdn    FQDN Vault will listen/advertise on (e.g. vault.internal.example.com)"
    echo "  ansible-user  Local user that runs Ansible playbooks (default: ansible)"
    exit 1
}

[ $# -lt 1 ] && usage
VAULT_FQDN="$1"
ANSIBLE_USER="${2:-ansible}"
TOTAL_STEPS=9

# ---------------------------------------------------------------------------
# Rollback on failure
# ---------------------------------------------------------------------------
cleanup() {
    local exit_code=$?
    if [ $exit_code -ne 0 ]; then
        err "Installation failed at step. Rolling back partial changes..."
        systemctl stop vault 2>/dev/null || true
        rm -rf /etc/vault.d/vault.hcl.new 2>/dev/null || true
    fi
    exit $exit_code
}
trap cleanup ERR

# ---------------------------------------------------------------------------
# Root check
# ---------------------------------------------------------------------------
if [ "$(id -u)" -ne 0 ]; then
    err "This script must be run as root or with sudo."
    exit 1
fi

# ---------------------------------------------------------------------------
# [1/N] Detect distro
# ---------------------------------------------------------------------------
log 1 $TOTAL_STEPS "Detecting distribution..."
if [ -f /etc/os-release ]; then
    . /etc/os-release
    case "$ID" in
        ubuntu|debian) PKG_MGR="apt"; PKG_INSTALL="apt install -y" ;;
        almalinux|rocky|centos|rhel|ol|fedora) PKG_MGR="dnf"; PKG_INSTALL="dnf install -y" ;;
        amzn) PKG_MGR="yum"; PKG_INSTALL="yum install -y" ;;
        *) err "Unsupported distro: $ID"; exit 1 ;;
    esac
else
    err "/etc/os-release not found. Cannot detect distro."
    exit 1
fi
echo "Detected: $ID ($PKG_MGR)"

# ---------------------------------------------------------------------------
# [2/N] Prerequisite tools
# ---------------------------------------------------------------------------
log 2 $TOTAL_STEPS "Installing prerequisite tools..."
if [ "$PKG_MGR" = "apt" ]; then
    apt update
    $PKG_INSTALL gnupg software-properties-common curl python3-pip
else
    $PKG_INSTALL curl python3-pip dnf-plugins-core || true
fi

command -v curl >/dev/null || { err "curl is required but missing."; exit 1; }

# ---------------------------------------------------------------------------
# [3/N] Add HashiCorp repo and install Vault
# ---------------------------------------------------------------------------
log 3 $TOTAL_STEPS "Adding HashiCorp repository and installing Vault..."
if [ "$PKG_MGR" = "apt" ]; then
    curl -fsSL https://apt.releases.hashicorp.com/gpg | gpg --dearmor -o /usr/share/keyrings/hashicorp-archive-keyring.gpg
    echo "deb [signed-by=/usr/share/keyrings/hashicorp-archive-keyring.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" \
        > /etc/apt/sources.list.d/hashicorp.list
    apt update
    $PKG_INSTALL vault
else
    # RHEL family: dnf and yum both support config-manager repo add
    if [ "$PKG_MGR" = "dnf" ]; then
        dnf config-manager --add-repo https://rpm.releases.hashicorp.com/RHEL/hashicorp.repo
    else
        yum-config-manager --add-repo https://rpm.releases.hashicorp.com/RHEL/hashicorp.repo 2>/dev/null || \
            curl -fsSL https://rpm.releases.hashicorp.com/RHEL/hashicorp.repo -o /etc/yum.repos.d/hashicorp.repo
    fi
    $PKG_INSTALL vault
fi

command -v vault >/dev/null || { err "Vault binary not found after install."; exit 1; }

# ---------------------------------------------------------------------------
# [4/N] Install Ansible + hashi_vault collection
# ---------------------------------------------------------------------------
log 4 $TOTAL_STEPS "Installing Ansible and community.hashi_vault collection..."
if [ "$PKG_MGR" = "apt" ]; then
    $PKG_INSTALL ansible
else
    $PKG_INSTALL ansible || $PKG_INSTALL epel-release ansible
fi
pip3 install --quiet hvac
ansible-galaxy collection install community.hashi_vault --force

# ---------------------------------------------------------------------------
# [5/N] Create vault system user/dirs
# ---------------------------------------------------------------------------
log 5 $TOTAL_STEPS "Creating data directories with correct ownership..."
id vault >/dev/null 2>&1 || useradd --system --home /etc/vault.d --shell /sbin/nologin vault
mkdir -p /opt/vault/data /etc/vault.d/tls
chown -R vault:vault /opt/vault/data /etc/vault.d
chmod 750 /opt/vault/data
chmod 755 /etc/vault.d
chmod 700 /etc/vault.d/tls

# ---------------------------------------------------------------------------
# [6/N] Write Vault configuration
# ---------------------------------------------------------------------------
log 6 $TOTAL_STEPS "Writing Vault server configuration..."
cat > /etc/vault.d/vault.hcl <<EOF
storage "raft" {
  path    = "/opt/vault/data"
  node_id = "vault-node-1"
}

listener "tcp" {
  address       = "0.0.0.0:8200"
  tls_cert_file = "/etc/vault.d/tls/vault-cert.pem"
  tls_key_file  = "/etc/vault.d/tls/vault-key.pem"
}

api_addr     = "https://${VAULT_FQDN}:8200"
cluster_addr = "https://${VAULT_FQDN}:8201"
ui           = true
EOF
chown vault:vault /etc/vault.d/vault.hcl
chmod 640 /etc/vault.d/vault.hcl

if [ ! -f /etc/vault.d/tls/vault-cert.pem ] || [ ! -f /etc/vault.d/tls/vault-key.pem ]; then
    warn "No TLS certificate found at /etc/vault.d/tls/. Generating a self-signed cert for bootstrap."
    warn "Replace with a CA-issued certificate before production use."
    openssl req -x509 -newkey rsa:4096 -sha256 -days 365 -nodes \
        -keyout /etc/vault.d/tls/vault-key.pem \
        -out /etc/vault.d/tls/vault-cert.pem \
        -subj "/CN=${VAULT_FQDN}" \
        -addext "subjectAltName=DNS:${VAULT_FQDN}" >/dev/null 2>&1
    chown vault:vault /etc/vault.d/tls/vault-cert.pem /etc/vault.d/tls/vault-key.pem
    chmod 640 /etc/vault.d/tls/vault-key.pem
    chmod 644 /etc/vault.d/tls/vault-cert.pem
fi

# ---------------------------------------------------------------------------
# [7/N] Configure firewall
# ---------------------------------------------------------------------------
log 7 $TOTAL_STEPS "Configuring firewall for Vault port 8200/tcp..."
if command -v ufw >/dev/null 2>&1 && ufw status | grep -q "Status: active"; then
    ufw allow 8200/tcp
elif command -v firewall-cmd >/dev/null 2>&1 && systemctl is-active --quiet firewalld; then
    firewall-cmd --permanent --add-port=8200/tcp
    firewall-cmd --reload
else
    warn "No active firewall manager detected (ufw/firewalld). Skipping firewall rule."
fi

# ---------------------------------------------------------------------------
# [8/N] Start and enable Vault
# ---------------------------------------------------------------------------
log 8 $TOTAL_STEPS "Enabling and starting Vault service..."
systemctl enable --now vault
sleep 3

if ! systemctl is-active --quiet vault; then
    err "Vault service failed to start. Check: journalctl -u vault"
    exit 1
fi

# ---------------------------------------------------------------------------
# [9/N] Prepare Ansible Vault bootstrap directory
# ---------------------------------------------------------------------------
log 9 $TOTAL_STEPS "Setting up Ansible Vault bootstrap directory for user '${ANSIBLE_USER}'..."
if ! id "$ANSIBLE_USER" >/dev/null 2>&1; then
    warn "User '${ANSIBLE_USER}' does not exist. Creating it."
    useradd --create-home --shell /bin/bash "$ANSIBLE_USER"
fi

ANSIBLE_HOME=$(getent passwd "$ANSIBLE_USER" | cut -d: -f6)
mkdir -p "${ANSIBLE_HOME}/vault-bootstrap"
chown "${ANSIBLE_USER}:${ANSIBLE_USER}" "${ANSIBLE_HOME}/vault-bootstrap"
chmod 700 "${ANSIBLE_HOME}/vault-bootstrap"

cat > "${ANSIBLE_HOME}/vault-bootstrap/README.txt" <<EOF
Next manual steps (run as an operator, not via this script):
1. export VAULT_ADDR='https://${VAULT_FQDN}:8200'
2. vault operator init -key-shares=5 -key-threshold=3
3. Store unseal keys and root token in a secure secret manager (not shell history).
4. vault auth enable approle
5. Create least-privilege policy + AppRole, then encrypt the resulting secret_id
   with: ansible-vault encrypt_string
EOF
chown "${ANSIBLE_USER}:${ANSIBLE_USER}" "${ANSIBLE_HOME}/vault-bootstrap/README.txt"
chmod 600 "${ANSIBLE_HOME}/vault-bootstrap/