unkin/puppet-prod
2
0
Fork 0
Code Issues 10 Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request 'feat: auto-unseal vault every hour' (#132) from neoloc/vault_unseal_check into develop

Browse Source 
Reviewed-on: https://git.query.consul/unkinben/puppet-prod/pulls/132
This commit is contained in:
Ben Vincent 2024-08-06 22:51:54 +10:00
commit 3ce2ec3754
1 changed files with 10 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
site/profiles/manifests/vault/unseal.pp
View File

@ -34,4 +34,14 @@ class profiles::vault::unseal (
require => File['/usr/local/bin/vault-unseal.sh'], require => File['/usr/local/bin/vault-unseal.sh'],
subscribe => [Service['vault'],File['/etc/vault/unseal_keys']], subscribe => [Service['vault'],File['/etc/vault/unseal_keys']],
} }
# restart the vault-unseal service hourly to ensure vault is unsealled
cron { 'restart_vault_unseal':
ensure => 'present',
user => 'root',
command => '/bin/systemctl restart vault-unseal',
minute => fqdn_rand(60),
hour => '*',
require => Service['vault-unseal'],
}
} }