Vault security hardening and role isolation

roles/vault/tasks/cluster/init.yml

@@ -28,6 +28,7 @@
 
 - name: cluster/init | Ensure the vault_secrets_dir exists
   file:
+    mode: 0750
     path: "{{ vault_secrets_dir }}"
     state: directory
 
@@ -35,12 +36,14 @@
   copy:
     content: "{{ vault_unseal_keys|join('\n') }}"
     dest: "{{ vault_secrets_dir }}/unseal_keys"
+    mode: 0640
   when: not vault_cluster_is_initialized
 
 - name: cluster/init | Ensure all in groups.vault have the root_token locally
   copy:
     content: "{{ vault_root_token }}"
     dest: "{{ vault_secrets_dir }}/root_token"
+    mode: 0640
   when: not vault_cluster_is_initialized
 
 - name: cluster/init | Ensure vault_headers and vault statuses are updated