[Elao - App] Vault cli support

elao.app/.manala/Makefile.tmpl

@@ -110,6 +110,25 @@ docker:
 
 endif
 
+#########
+# Vault #
+#########
+
+include $(_ROOT_DIR)/.manala/make/vault.mk
+
+ifdef VAULT_ADDR
+HELP += $(call help_section, Vault)
+
+HELP += $(call help,vault.login,Vault login)
+vault.login:
+	$(call vault_login)
+
+else
+vault.login:
+	$(call message_warning, \"VAULT_ADDR\" environment variable has not been set)
+
+endif
+
 {{ if .Vars.releases -}}
 ############
 # Releases #

elao.app/.manala/ansible/inventories/system.yaml.tmpl

@@ -496,4 +496,7 @@ system:
           {{- .docker.containers | toYaml | nindent 10 }}
         {{- end }}
 
+        # Vault Cli
+        manala_vault_cli_enabled: true
+
 {{- end }}

elao.app/.manala/ansible/roles/system/defaults/main.yaml

@@ -30,3 +30,4 @@ manala_elasticsearch_enabled: false
 manala_influxdb_enabled: false
 manala_docker_enabled: false
 manala_gomplate_enabled: false
+manala_vault_cli_enabled: false

elao.app/.manala/ansible/roles/system/tasks/main.yaml

@@ -179,3 +179,9 @@
       name: gomplate
   when: manala_gomplate_enabled
   tags: [gomplate]
+
+# Vault Cli
+- import_role:
+      name: vault_cli
+  when: manala_vault_cli_enabled
+  tags: [vault]

elao.app/.manala/make/vault.mk

@@ -0,0 +1,9 @@
+#########
+# Vault #
+#########
+
+define vault_login
+	$(call message, Vault login)
+	read -p "Username: " USERNAME; \
+		vault login -method=userpass username=$${USERNAME}
+endef

elao.app/README.md

@@ -537,16 +537,20 @@ test.phpunit@integration:
 In order to deploy secrets, you can use [Gomplate](https://docs.gomplate.ca), called by a make task.
 Gomplate takes a template, queries its values from a Vault server and renders a file.
 
-Add the following task in the `Makefile`:
+Add the following tasks in the `Makefile`:
 
 ```
 ###########
 # Secrets #
 ###########
 
-secrets/%: _secrets
-	gomplate --config=secrets/$(*)
-_secrets:
+secrets@production:
+	gomplate --config=secrets/env.production.yml
+	gomplate --config=secrets/parameters.production.yml
+
+secrets@staging:
+	gomplate --config=secrets/env.staging.yml
+	gomplate --config=secrets/parameters.staging.yml
 ```
 
 Put templates in a `secrets` directory at the root of the project.
@@ -557,32 +561,30 @@ Here is an example of template:
 %YAML 1.1
 ---
 
-datasources:
-  vault:
-    url: vault+https://my-vault-server.com
-
 outputFiles:
   - /path/to/rendered/file
 
 in: |
   Loop on all values of the secret:
-    {{ range $key, $value := (datasource "vault" "MyApp/data/env").data -}}
+    {{ range $key, $value := (datasource "vault:///MyApp/data/env").data -}}
     {{ $key }} = {{ $value | quote }}
     {{ end -}}
 
   Query only one value of the secret:
-    {{ (datasource "vault" "MyApp/data/env").data.value1 -}}
+    {{ (datasource "vault:///MyApp/data/env").data.value1 -}}
 ```
 
 /!\ Note that the path to the secret will slightly differ from what the Vault server will display \
 /!\ If the path is `MyApp/production/env` on the Vault server, it will become `MyApp/data/production/env` in the template
 
 Gomplate uses [Go Template syntax](https://docs.gomplate.ca/syntax/)
 
-To render the file, call the template with the `make secrets/%` task, where `%` is the name of the template.
+In order to use secrets in development or integration environment, a `VAULT_ADDR` environment variable must be set,
+defining the Vault server address expressed as an URL, for example: `https://127.0.0.1:8200`
+Login to the vaut server using:
 
-```shell
-make secrets/.env.prod
+```
+$ make vault.login
 ```
 
 ## Tips, Tricks, and Tweaks