Enhancing vault integration

Added persistent storage

Auto-create vault and awx via playbooks

Create a new pattern for custom containers where we can do initialization

Auto-install roles needed for plumbing via the Makefile

tools/docker-compose/ansible/roles/sources/defaults/main.yml

@@ -1,5 +1,4 @@
 ---
-sources_dest: '../_sources'
 compose_name: 'docker-compose.yml'
 awx_image: 'ghcr.io/ansible/awx_devel'
 pg_port: 5432

tools/docker-compose/ansible/roles/sources/tasks/main.yml

@@ -101,10 +101,6 @@
   include_tasks: ldap.yml
   when: enable_ldap | bool
 
-- name: Include Vault tasks if enabled
-  include_tasks: vault.yaml
-  when: enable_vault | bool
-
 - name: Render Docker-Compose
   template:
     src: docker-compose.yml.j2

tools/docker-compose/ansible/roles/sources/tasks/vault.yaml

@@ -1,20 +0,0 @@
----
-- name: create vault secret file and scope into ansible-runtime
-  block:
-    - ansible.builtin.stat:
-        path: "{{ sources_dest }}/secrets/{{ item }}.yml"
-      register: vault_secret
-      loop:
-        - vault_password
-
-    - ansible.builtin.template:
-        src: "secrets.yml.j2"
-        dest: "{{ sources_dest }}/secrets/{{ item.item }}.yml"
-        mode: "0600"
-      loop: "{{ vault_secret.results }}"
-      loop_control:
-        label: "{{ item.item }}"
-
-    - include_vars: "{{ sources_dest }}/secrets/{{ item.item }}.yml"
-      loop: "{{ vault_secret.results }}"
-      no_log: true

tools/docker-compose/ansible/roles/sources/templates/docker-compose.yml.j2

@@ -235,16 +235,18 @@ services:
 {% endif %}
 {% if enable_vault|bool %}
   vault:
-    image: hashicorp/vault:latest
+    image: hashicorp/vault:1.14
     container_name: tools_vault_1
+    command: server
     hostname: vault
     ports:
       - "1234:1234"
     environment:
-      VAULT_DEV_ROOT_TOKEN_ID: "{{ vault_password }}"
-      VAULT_DEV_LISTEN_ADDRESS: "0.0.0.0:1234"
+      VAULT_LOCAL_CONFIG: '{"storage": {"file": {"path": "/vault/file"}}, "listener": [{"tcp": { "address": "0.0.0.0:1234", "tls_disable": true}}], "default_lease_ttl": "168h", "max_lease_ttl": "720h", "ui": true}'
     cap_add:
       - IPC_LOCK
+    volumes:
+      - 'hashicorp_vault_data:/vault/file'
 {% endif %}
 
 volumes:
@@ -260,6 +262,10 @@ volumes:
     name: tools_ldap_1
     driver: local
 {% endif %}
+{% if enable_vault|bool %}
+  hashicorp_vault_data:
+    name: tools_vault_1
+{% endif %}
 {% if enable_prometheus|bool %}
   prometheus_storage:
     name: tools_prometheus_storage