feat: manage openbao audit devices

- manage openbao audit devices in the configuration file
- enable audit and audit_raw logs

site/profiles/manifests/vault/server.pp

@@ -15,7 +15,7 @@ class profiles::vault::server (
   Stdlib::Absolutepath $ssl_crt     = '/etc/pki/tls/vault/certificate.crt',
   Stdlib::Absolutepath $ssl_key     = '/etc/pki/tls/vault/private.key',
   Stdlib::Absolutepath $ssl_ca      = '/etc/pki/tls/certs/ca-bundle.crt',
-  Stdlib::Absolutepath $audit_log   = '/var/log/vault_audit.log',
+  Optional[Array[Hash]] $audit_devices = undef,
 ){
 
   # set a datacentre/cluster name
@@ -64,18 +64,8 @@ class profiles::vault::server (
       },
       api_addr           => "${http_scheme}://${::facts['networking']['fqdn']}:${client_port}",
       extra_config       => {
-        cluster_addr => "${http_scheme}://${::facts['networking']['fqdn']}:${cluster_port}",
-        audit        => [
-          {
-            file => {
-              'audit-file' => {
-                options => {
-                  file_path => $audit_log,
-                }
-              }
-            }
-          }
-        ],
+        cluster_addr                    => "${http_scheme}://${::facts['networking']['fqdn']}:${cluster_port}",
+        unsafe_allow_api_audit_creation => true,
       },
       listener           => [
         {
@@ -97,13 +87,6 @@ class profiles::vault::server (
       ]
     }
 
-    # ensure the vault audit log exists
-    file { $audit_log:
-      ensure => 'file',
-      owner  => 'vault',
-      group  => 'vault',
-      mode   => '0600',
-    }
 
     service { 'vault':
       ensure    => true,