Vendor Galaxy Roles and Collections

ansible_collections/debops/debops/roles/hashicorp/COPYRIGHT

@@ -0,0 +1,19 @@
+debops.hashicorp - Securely install HashiCorp applications
+
+Copyright (C) 2016      Maciej Delmanowski <drybjed@gmail.com>
+Copyright (C) 2016-2017 DebOps <https://debops.org/>
+SPDX-License-Identifier: GPL-3.0-only
+
+This Ansible role is part of DebOps.
+
+DebOps is free software; you can redistribute it and/or modify
+it under the terms of the GNU General Public License version 3, as
+published by the Free Software Foundation.
+
+DebOps is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU General Public License for more details.
+
+You should have received a copy of the GNU General Public License
+along with DebOps. If not, see https://www.gnu.org/licenses/.

ansible_collections/debops/debops/roles/hashicorp/defaults/main.yml

@@ -0,0 +1,311 @@
+---
+# .. vim: foldmarker=[[[,]]]:foldmethod=marker
+
+# .. Copyright (C) 2016      Maciej Delmanowski <drybjed@gmail.com>
+# .. Copyright (C) 2016-2017 DebOps <https://debops.org/>
+# .. SPDX-License-Identifier: GPL-3.0-only
+
+# .. _hashicorp__ref_defaults:
+
+# debops.hashicorp default variables [[[
+# ======================================
+
+# .. contents:: Sections
+#    :local:
+#
+# .. include:: ../../../../includes/global.rst
+
+
+# APT package management [[[
+# --------------------------
+
+# .. envvar:: hashicorp__base_packages [[[
+#
+# List of APT packages required by the role to function.
+hashicorp__base_packages: [ 'rsync', 'openssl', 'ca-certificates', 'unzip' ]
+
+                                                                   # ]]]
+# .. envvar:: hashicorp__packages [[[
+#
+# List of additional APT packages to install on hosts managed by the role.
+hashicorp__packages: []
+
+                                                                   # ]]]
+# .. envvar:: hashicorp__dependent_packages [[[
+#
+# List of APT packages to install requested by other Ansible roles.
+hashicorp__dependent_packages: []
+                                                                   # ]]]
+                                                                   # ]]]
+# HashiCorp user account [[[
+# --------------------------
+
+# .. envvar:: hashicorp__user [[[
+#
+# Name of the system account which will perform signature and archive
+# verification.
+hashicorp__user: 'hashicorp'
+
+                                                                   # ]]]
+# .. envvar:: hashicorp__group [[[
+#
+# Name of the primary system group of the HashiCorp_ account.
+hashicorp__group: 'hashicorp'
+
+                                                                   # ]]]
+# .. envvar:: hashicorp__home [[[
+#
+# Path to the home directory of the HashiCorp_ account.
+hashicorp__home: '{{ (ansible_local.fhs.home | d("/var/local"))
+                     + "/" + hashicorp__user }}'
+
+                                                                   # ]]]
+# .. envvar:: hashicorp__comment [[[
+#
+# The GECOS string set for the HashiCorp_ account.
+hashicorp__comment: 'HashiCorp Application Manager'
+
+                                                                   # ]]]
+# .. envvar:: hashicorp__shell [[[
+#
+# The default shell of the HashiCorp_ account.
+hashicorp__shell: '/usr/sbin/nologin'
+                                                                   # ]]]
+                                                                   # ]]]
+# OpenPGP key and keyserver [[[
+# -----------------------------
+
+# See :ref:`hashicorp__ref_security` for details about how the role uses the
+# HashiCorp_ company OpenPGP keys.
+
+# .. envvar:: hashicorp__gpg_key_id [[[
+#
+# The OpenPGP key fingerprint of the HashiCorp_ company.
+hashicorp__gpg_key_id: 'C874 011F 0AB4 0511 0D02 1055 3436 5D94 72D7 468F'
+
+                                                                   # ]]]
+# .. envvar:: hashicorp__keyserver [[[
+#
+# URL of the OpenPGP keyserver used to obtain the HashiCorp_ OpenPGP key.
+hashicorp__keyserver: '{{ ansible_local.keyring.keyserver | d("hkp://keyserver.ubuntu.com") }}'
+                                                                   # ]]]
+                                                                   # ]]]
+# HashiCorp Application lists [[[
+# -------------------------------
+
+# .. envvar:: hashicorp__applications [[[
+#
+# List of HashiCorp_ applications that should be installed on a given host.
+# To find out what applications are supported, check the names of the keys
+# in the :envvar:`hashicorp__default_version_map` dictionary.
+hashicorp__applications: []
+
+                                                                   # ]]]
+# .. envvar:: hashicorp__dependent_applications [[[
+#
+# List of HashiCorp_ applications that are requested by other Ansible roles
+# using dependent variables.
+hashicorp__dependent_applications: []
+                                                                   # ]]]
+                                                                   # ]]]
+# HashiCorp application versions [[[
+# ----------------------------------
+
+# .. envvar:: hashicorp__default_version_map [[[
+#
+# YAML dictionary which maps the HashiCorp_ application names to their versions.
+# This is the main dictionary and shouldn't be modified by the user if
+# possible.
+hashicorp__default_version_map:
+  'atlas-upload-cli':  '0.2.0'
+  'consul':            '0.8.3'
+  'consul-replicate':  '0.3.1'
+  'consul-template':   '0.18.3'
+  'docker-base':       '0.0.4'
+  'docker-basetool':   '0.0.3'
+  'envconsul':         '0.6.2'
+  'nomad':             '0.5.6'
+  'otto':              '0.2.0'
+  'packer':            '1.0.0'
+  'serf':              '0.8.1'
+  'terraform':         '0.9.5'
+  'vault':             '0.7.2'
+  'vault-ssh-helper':  '0.1.3'
+
+  # The applications below have incompatible release formats:
+  #'vagrant':          '1.9.5'
+
+                                                                   # ]]]
+# .. envvar:: hashicorp__version_map [[[
+#
+# An additional YAML dictionary which defines mapping between HashiCorp_
+# applications and their versions. This dictionary should be used to override
+# the default version if necessary.
+hashicorp__version_map: {}
+
+                                                                   # ]]]
+# .. envvar:: hashicorp__combined_version_map [[[
+#
+# The YAML dictionary used by the role to lookup specific versions of HashiCorp_
+# applications to install.
+hashicorp__combined_version_map: '{{ hashicorp__default_version_map
+                                     | combine(hashicorp__version_map) }}'
+                                                                   # ]]]
+                                                                   # ]]]
+# Archive binary overrides [[[
+# ----------------------------
+
+# .. envvar:: hashicorp__default_binary_map [[[
+#
+# Some of the HashiCorp_ applications use different location or name of binaries
+# in their archives. This YAML dictionary is used to override the default
+# binary name(s) to the correct ones when necessary. Paths are relative to the
+# specific archive directory.
+hashicorp__default_binary_map:
+  'atlas-upload-cli': 'atlas-upload'
+  'docker-base':      [ 'bin/dumb-init', 'bin/gosu' ]
+
+                                                                   # ]]]
+# .. envvar:: hashicorp__binary_map [[[
+#
+# Custom YAML dictionary with binary name overrides. This variable can be used
+# by the user when necessary.
+hashicorp__binary_map: {}
+
+                                                                   # ]]]
+# .. envvar:: hashicorp__combined_binary_map [[[
+#
+# The YAML dictionary variable used by the role to override paths to the
+# specific archive binaries.
+hashicorp__combined_binary_map: '{{ hashicorp__default_binary_map
+                                    | combine(hashicorp__binary_map) }}'
+                                                                   # ]]]
+                                                                   # ]]]
+# Base directory paths [[[
+# ------------------------
+
+# .. envvar:: hashicorp__src [[[
+#
+# Base path to the directory with HashiCorp_ binary archives, their hash
+# signatures and OpenPGP signatures.
+hashicorp__src: '{{ (ansible_local.fhs.src | d("/usr/local/src"))
+                    + "/" + hashicorp__user + "/" +
+                     (hashicorp__base_url.split("://") | last | split("/") | first) }}'
+
+                                                                   # ]]]
+# .. envvar:: hashicorp__lib [[[
+#
+# Base path to the directory where HashiCorp_ archives are unpacked after
+# verification.
+hashicorp__lib: '{{ (ansible_local.fhs.lib | d("/usr/local/lib"))
+                    + "/" + hashicorp__user }}'
+
+                                                                   # ]]]
+# .. envvar:: hashicorp__bin [[[
+#
+# Base path to the directory where HashiCorp_ application binaries will be
+# installed by the ``root`` account.
+hashicorp__bin: '{{ ansible_local.fhs.bin | d("/usr/local/bin") }}'
+                                                                   # ]]]
+                                                                   # ]]]
+# HashiCorp application repositories [[[
+# --------------------------------------
+
+# .. envvar:: hashicorp__base_url [[[
+#
+# The base URL of the HashiCorp_ webserver with application releases.
+hashicorp__base_url: 'https://releases.hashicorp.com/'
+
+                                                                   # ]]]
+# .. envvar:: hashicorp__platform [[[
+#
+# Name of the current OS platform in the format used by the HashiCorp_
+# application archive filenames.
+hashicorp__platform: '{{ ansible_system | lower }}'
+
+                                                                   # ]]]
+# .. envvar:: hashicorp__architecture [[[
+#
+# Key used to lookup current system architecture.
+hashicorp__architecture: '{{ ansible_architecture }}'
+
+                                                                   # ]]]
+# .. envvar:: hashicorp__architecture_map [[[
+#
+# YAML dictionary that maps the system architecture as used by Ansible to the
+# architecture names used in the HashiCorp_ archive filenames.
+hashicorp__architecture_map:
+  'x86_64': 'amd64'
+  'i386': '386'
+  'armhf': 'arm'
+
+                                                                   # ]]]
+# .. envvar:: hashicorp__tar_suffix [[[
+#
+# The filename suffix of the HashiCorp_ application archive.
+hashicorp__tar_suffix: '{{ hashicorp__platform + "_"
+                           + hashicorp__architecture_map[hashicorp__architecture]
+                           + ".zip" }}'
+
+                                                                   # ]]]
+# .. envvar:: hashicorp__hash_suffix [[[
+#
+# The filename suffix of the file which contains SHA256 hashes of the released
+# files.
+hashicorp__hash_suffix: 'SHA256SUMS'
+
+                                                                   # ]]]
+# .. envvar:: hashicorp__sig_suffix [[[
+#
+# The filename suffix of the file which contains OpenPGP signature of the file
+# with SHA256 hashes, signed by the HashiCorp_ OpenPGP key.
+hashicorp__sig_suffix: '{{ hashicorp__hash_suffix + ".sig" }}'
+                                                                   # ]]]
+                                                                   # ]]]
+# Consul Web UI configuration [[[
+# -------------------------------
+
+# .. envvar:: hashicorp__consul_webui [[[
+#
+# Boolean variable which controls if the Consul Web UI should be installed
+# alongside ``consul``. By default the Web UI files are not installed to allow
+# headless installation.
+hashicorp__consul_webui: '{{ ansible_local.hashicorp.consul_webui | d(False) | bool }}'
+
+                                                                   # ]]]
+# .. envvar:: hashicorp__consul_webui_suffix [[[
+#
+# The filename suffix of the Consul Web UI archive file.
+hashicorp__consul_webui_suffix: 'web_ui.zip'
+
+                                                                   # ]]]
+# .. envvar:: hashicorp__consul_webui_path [[[
+#
+# Absolute path where the Consul Web UI files should be installed.
+hashicorp__consul_webui_path: '{{ ansible_local.nginx.www | d("/srv/www") + "/consul/sites/public" }}'
+                                                                   # ]]]
+                                                                   # ]]]
+# Configuration for other Ansible roles [[[
+# -----------------------------------------
+
+# .. envvar:: hashicorp__keyring__dependent_gpg_keys [[[
+#
+# Configuration for the :ref:`debops.keyring` Ansible role.
+hashicorp__keyring__dependent_gpg_keys:
+
+  - user: '{{ hashicorp__user }}'
+    group: '{{ hashicorp__group }}'
+    home: '{{ hashicorp__home }}'
+    id: '{{ hashicorp__gpg_key_id }}'
+    state: '{{ "present"
+               if (hashicorp__applications or hashicorp__dependent_applications)
+               else "absent" }}'
+
+    # The old GPG key has been revoked
+    # https://discuss.hashicorp.com/t/hcsec-2021-12-codecov-security-event-and-hashicorp-gpg-key-exposure/23512
+  - user: '{{ hashicorp__user }}'
+    id: '91A6 E7F8 5D05 C656 30BE F189 5185 2D87 348F FC4C'
+    state: 'absent'
+                                                                   # ]]]
+                                                                   # ]]]
+                                                                   # ]]]

ansible_collections/debops/debops/roles/hashicorp/meta/main.yml

@@ -0,0 +1,37 @@
+---
+# Copyright (C) 2016      Maciej Delmanowski <drybjed@gmail.com>
+# Copyright (C) 2016-2022 DebOps <https://debops.org/>
+# SPDX-License-Identifier: GPL-3.0-only
+
+# Ensure that custom Ansible plugins and modules included in the main DebOps
+# collection are available to roles in other collections.
+collections: [ 'debops.debops' ]
+
+dependencies: []
+
+galaxy_info:
+
+  author: 'Maciej Delmanowski'
+  description: 'Securely install HashiCorp applications'
+  company: 'DebOps'
+  license: 'GPL-3.0-only'
+  min_ansible_version: '2.4.0'
+
+  platforms:
+
+    - name: 'Ubuntu'
+      versions: [ 'all' ]
+
+    - name: 'Debian'
+      versions: [ 'all' ]
+
+  galaxy_tags:
+    - hashicorp
+    - consul
+    - docker
+    - nomad
+    - otto
+    - packer
+    - serf
+    - terraform
+    - vault

ansible_collections/debops/debops/roles/hashicorp/meta/watch-atlas-upload-cli

@@ -0,0 +1,10 @@
+# Copyright (C) 2016      Maciej Delmanowski <drybjed@gmail.com>
+# Copyright (C) 2016-2017 DebOps <https://debops.org/>
+# SPDX-License-Identifier: GPL-3.0-only
+
+# Role: hashicorp
+# Package: atlas-upload-cli
+# Version: 0.2.0
+
+version=4
+https://github.com/hashicorp/atlas-upload-cli/tags .*\/v?(\d\S+)\.tar\.gz

ansible_collections/debops/debops/roles/hashicorp/meta/watch-consul

@@ -0,0 +1,10 @@
+# Copyright (C) 2016      Maciej Delmanowski <drybjed@gmail.com>
+# Copyright (C) 2016-2017 DebOps <https://debops.org/>
+# SPDX-License-Identifier: GPL-3.0-only
+
+# Role: hashicorp
+# Package: consul
+# Version: 0.8.3
+
+version=4
+https://github.com/hashicorp/consul/tags .*\/v?(\d\S+)\.tar\.gz

ansible_collections/debops/debops/roles/hashicorp/meta/watch-consul-replicate

@@ -0,0 +1,10 @@
+# Copyright (C) 2016      Maciej Delmanowski <drybjed@gmail.com>
+# Copyright (C) 2016-2017 DebOps <https://debops.org/>
+# SPDX-License-Identifier: GPL-3.0-only
+
+# Role: hashicorp
+# Package: consul-replicate
+# Version: 0.3.1
+
+version=4
+https://github.com/hashicorp/consul-replicate/tags .*\/v?(\d\S+)\.tar\.gz

ansible_collections/debops/debops/roles/hashicorp/meta/watch-consul-template

@@ -0,0 +1,10 @@
+# Copyright (C) 2016      Maciej Delmanowski <drybjed@gmail.com>
+# Copyright (C) 2016-2017 DebOps <https://debops.org/>
+# SPDX-License-Identifier: GPL-3.0-only
+
+# Role: hashicorp
+# Package: consul-template
+# Version: 0.18.3
+
+version=4
+https://github.com/hashicorp/consul-template/tags .*\/v?(\d\S+)\.tar\.gz

ansible_collections/debops/debops/roles/hashicorp/meta/watch-docker-base

@@ -0,0 +1,10 @@
+# Copyright (C) 2016      Maciej Delmanowski <drybjed@gmail.com>
+# Copyright (C) 2016-2017 DebOps <https://debops.org/>
+# SPDX-License-Identifier: GPL-3.0-only
+
+# Role: hashicorp
+# Package: docker-base
+# Version: 0.3.1
+
+version=4
+https://github.com/hashicorp/docker-base/tags .*\/v?(\d\S+)\.tar\.gz

ansible_collections/debops/debops/roles/hashicorp/meta/watch-docker-basetool

@@ -0,0 +1,10 @@
+# Copyright (C) 2016      Maciej Delmanowski <drybjed@gmail.com>
+# Copyright (C) 2016-2017 DebOps <https://debops.org/>
+# SPDX-License-Identifier: GPL-3.0-only
+
+# Role: hashicorp
+# Package: docker-basetool
+# Version: 0.0.3
+
+version=4
+https://github.com/hashicorp/docker-basetool/tags .*\/v?(\d\S+)\.tar\.gz

ansible_collections/debops/debops/roles/hashicorp/meta/watch-envconsul

@@ -0,0 +1,10 @@
+# Copyright (C) 2016      Maciej Delmanowski <drybjed@gmail.com>
+# Copyright (C) 2016-2017 DebOps <https://debops.org/>
+# SPDX-License-Identifier: GPL-3.0-only
+
+# Role: hashicorp
+# Package: envconsul
+# Version: 0.6.2
+
+version=4
+https://github.com/hashicorp/envconsul/tags .*\/v?(\d\S+)\.tar\.gz

ansible_collections/debops/debops/roles/hashicorp/meta/watch-nomad

@@ -0,0 +1,10 @@
+# Copyright (C) 2016      Maciej Delmanowski <drybjed@gmail.com>
+# Copyright (C) 2016-2017 DebOps <https://debops.org/>
+# SPDX-License-Identifier: GPL-3.0-only
+
+# Role: hashicorp
+# Package: nomad
+# Version: 0.5.6
+
+version=4
+https://github.com/hashicorp/nomad/tags .*\/v?(\d\S+)\.tar\.gz

ansible_collections/debops/debops/roles/hashicorp/meta/watch-otto

@@ -0,0 +1,10 @@
+# Copyright (C) 2016      Maciej Delmanowski <drybjed@gmail.com>
+# Copyright (C) 2016-2017 DebOps <https://debops.org/>
+# SPDX-License-Identifier: GPL-3.0-only
+
+# Role: hashicorp
+# Package: otto
+# Version: 0.2.0
+
+version=4
+https://github.com/hashicorp/otto/tags .*\/v?(\d\S+)\.tar\.gz

ansible_collections/debops/debops/roles/hashicorp/meta/watch-packer

@@ -0,0 +1,10 @@
+# Copyright (C) 2016      Maciej Delmanowski <drybjed@gmail.com>
+# Copyright (C) 2016-2017 DebOps <https://debops.org/>
+# SPDX-License-Identifier: GPL-3.0-only
+
+# Role: hashicorp
+# Package: packer
+# Version: 1.0.0
+
+version=4
+https://github.com/hashicorp/packer/tags .*\/v?(\d\S+)\.tar\.gz

ansible_collections/debops/debops/roles/hashicorp/meta/watch-serf

@@ -0,0 +1,10 @@
+# Copyright (C) 2016      Maciej Delmanowski <drybjed@gmail.com>
+# Copyright (C) 2016-2017 DebOps <https://debops.org/>
+# SPDX-License-Identifier: GPL-3.0-only
+
+# Role: hashicorp
+# Package: serf
+# Version: 0.8.1
+
+version=4
+https://github.com/hashicorp/serf/tags .*\/v?(\d\S+)\.tar\.gz

ansible_collections/debops/debops/roles/hashicorp/meta/watch-terraform

@@ -0,0 +1,10 @@
+# Copyright (C) 2016      Maciej Delmanowski <drybjed@gmail.com>
+# Copyright (C) 2016-2017 DebOps <https://debops.org/>
+# SPDX-License-Identifier: GPL-3.0-only
+
+# Role: hashicorp
+# Package: terraform
+# Version: 0.9.5
+
+version=4
+https://github.com/hashicorp/terraform/tags .*\/v?(\d\S+)\.tar\.gz

ansible_collections/debops/debops/roles/hashicorp/meta/watch-vault

@@ -0,0 +1,10 @@
+# Copyright (C) 2016      Maciej Delmanowski <drybjed@gmail.com>
+# Copyright (C) 2016-2017 DebOps <https://debops.org/>
+# SPDX-License-Identifier: GPL-3.0-only
+
+# Role: hashicorp
+# Package: vault
+# Version: 0.7.2
+
+version=4
+https://github.com/hashicorp/vault/tags .*\/v?(\d\S+)\.tar\.gz

ansible_collections/debops/debops/roles/hashicorp/meta/watch-vault-ssh-helper

@@ -0,0 +1,10 @@
+# Copyright (C) 2016      Maciej Delmanowski <drybjed@gmail.com>
+# Copyright (C) 2016-2017 DebOps <https://debops.org/>
+# SPDX-License-Identifier: GPL-3.0-only
+
+# Role: hashicorp
+# Package: vault-ssh-helper
+# Version: 0.1.3
+
+version=4
+https://github.com/hashicorp/vault-ssh-helper/tags .*\/v?(\d\S+)\.tar\.gz

ansible_collections/debops/debops/roles/hashicorp/tasks/main.yml

@@ -0,0 +1,263 @@
+---
+# .. vim: foldmarker=[[[,]]]:foldmethod=marker
+
+# Copyright (C) 2016      Maciej Delmanowski <drybjed@gmail.com>
+# Copyright (C) 2016-2017 DebOps <https://debops.org/>
+# SPDX-License-Identifier: GPL-3.0-only
+
+- name: Import custom Ansible plugins
+  ansible.builtin.import_role:
+    name: 'ansible_plugins'
+
+- name: Import DebOps global handlers
+  ansible.builtin.import_role:
+    name: 'global_handlers'
+
+# APT package installation [[[1
+
+- name: Install required packages
+  ansible.builtin.package:
+    name: '{{ q("flattened", (hashicorp__base_packages
+                              + hashicorp__packages
+                              + hashicorp__dependent_packages)) }}'
+    state: 'present'
+  register: hashicorp__register_packages
+  until: hashicorp__register_packages is succeeded
+  when: (hashicorp__applications or hashicorp__dependent_applications)
+
+
+# User, group management [[[1
+
+- name: Create HashiCorp group
+  ansible.builtin.group:
+    name: '{{ hashicorp__group }}'
+    state: 'present'
+    system: True
+  when: (hashicorp__applications or hashicorp__dependent_applications)
+  tags: [ 'role::hashicorp:download', 'role::hashicorp:verify' ]
+
+- name: Create HashiCorp user
+  ansible.builtin.user:
+    name: '{{ hashicorp__user }}'
+    group: '{{ hashicorp__group }}'
+    home: '{{ hashicorp__home }}'
+    comment: '{{ hashicorp__comment }}'
+    shell: '{{ hashicorp__shell }}'
+    system: True
+    state: 'present'
+  when: (hashicorp__applications or hashicorp__dependent_applications)
+  tags: [ 'role::hashicorp:download', 'role::hashicorp:verify' ]
+
+
+# Filesystem directory management [[[1
+
+- name: Create source directories
+  ansible.builtin.file:
+    path: '{{ hashicorp__src + "/" + item + "/" + hashicorp__combined_version_map[item] }}'
+    state: 'directory'
+    owner: '{{ hashicorp__user }}'
+    group: '{{ hashicorp__group }}'
+    mode: '0755'
+  with_items: '{{ (hashicorp__applications + hashicorp__dependent_applications) | unique }}'
+  when: (hashicorp__applications or hashicorp__dependent_applications)
+  tags: [ 'role::hashicorp:download', 'role::hashicorp:verify' ]
+
+- name: Create library directories
+  ansible.builtin.file:
+    path: '{{ hashicorp__lib + "/" + item + "/" + hashicorp__combined_version_map[item] }}'
+    state: 'directory'
+    owner: '{{ hashicorp__user }}'
+    group: '{{ hashicorp__group }}'
+    mode: '0750'
+  with_items: '{{ (hashicorp__applications + hashicorp__dependent_applications) | unique }}'
+  when: (hashicorp__applications or hashicorp__dependent_applications)
+  tags: [ 'role::hashicorp:unpack', 'role::hashicorp:install' ]
+
+- name: Create Consul Web UI library directory
+  ansible.builtin.file:
+    path: '{{ hashicorp__lib + "/" + item + "/" + hashicorp__combined_version_map[item] + "/web_ui" }}'
+    state: 'directory'
+    owner: '{{ hashicorp__user }}'
+    group: '{{ hashicorp__group }}'
+    mode: '0755'
+  with_items: '{{ (hashicorp__applications + hashicorp__dependent_applications) | unique }}'
+  when: (hashicorp__consul_webui | bool and item == 'consul')
+
+- name: Create Consul Web UI directory
+  ansible.builtin.file:
+    path: '{{ hashicorp__consul_webui_path }}'
+    state: 'directory'
+    owner: 'root'
+    group: 'root'
+    mode: '0755'
+  when: (hashicorp__consul_webui | bool and
+         ('consul' in (hashicorp__applications + hashicorp__dependent_applications | unique)))
+
+
+# OpenPGP keys, application download and validation [[[1
+
+- name: Download and validate the tarballs
+  become: True
+  become_user: '{{ hashicorp__user }}'
+  when: (hashicorp__applications or hashicorp__dependent_applications)
+  block:
+
+    # HashiCorp application archive download [[[2
+
+    - name: Download requested application files
+      ansible.builtin.get_url:
+        url: '{{ hashicorp__base_url + item.0 + "/" +
+                 hashicorp__combined_version_map[item.0] + "/" + item.0 + "_" +
+                 hashicorp__combined_version_map[item.0] + "_" + item.1 }}'
+        dest: '{{ hashicorp__src + "/" + item.0 + "/" + hashicorp__combined_version_map[item.0] + "/" }}'
+        mode: '0644'
+      with_nested:
+        - '{{ (hashicorp__applications + hashicorp__dependent_applications) | unique }}'
+        - [ '{{ hashicorp__tar_suffix }}', '{{ hashicorp__hash_suffix }}', '{{ hashicorp__sig_suffix }}' ]
+      when: (ansible_local.hashicorp is not defined or
+             (ansible_local.hashicorp | d() and ansible_local.hashicorp.applications | d() and
+              (ansible_local.hashicorp.applications[item.0] is not defined or
+               (ansible_local.hashicorp.applications[item.0] != hashicorp__combined_version_map[item.0]))))
+      tags: [ 'role::hashicorp:download', 'role::hashicorp:verify' ]
+
+    - name: Download Consul Web UI
+      ansible.builtin.get_url:
+        url: '{{ hashicorp__base_url + item.0 + "/" +
+                 hashicorp__combined_version_map[item.0] + "/" + item.0 + "_" +
+                 hashicorp__combined_version_map[item.0] + "_" + item.1 }}'
+        dest: '{{ hashicorp__src + "/" + item.0 + "/" + hashicorp__combined_version_map[item.0] + "/" }}'
+        mode: '0644'
+      with_nested:
+        - [ 'consul' ]
+        - [ '{{ hashicorp__consul_webui_suffix }}' ]
+      when: (hashicorp__consul_webui | bool and
+             ('consul' in (hashicorp__applications + hashicorp__dependent_applications) | unique) and
+              (ansible_local.hashicorp is not defined or
+               (ansible_local.hashicorp | d() and ansible_local.hashicorp.applications | d() and
+                (ansible_local.hashicorp.applications['consul'] is not defined or
+                 (ansible_local.hashicorp.applications['consul'] != hashicorp__combined_version_map['consul'])) or
+                not ansible_local.hashicorp.consul_webui | bool)))
+      tags: [ 'role::hashicorp:download', 'role::hashicorp:verify' ]
+
+
+    # SHA256 signature verification [[[2
+
+    - name: Verify signatures with HashiCorp GPG key
+      ansible.builtin.command: gpg --verify {{ item + '_' + hashicorp__combined_version_map[item] + '_' + hashicorp__sig_suffix }}
+                            {{ item + '_' + hashicorp__combined_version_map[item] + '_' + hashicorp__hash_suffix }}
+      args:
+        chdir: '{{ hashicorp__src + "/" + item + "/" + hashicorp__combined_version_map[item] }}'
+      with_items: '{{ (hashicorp__applications + hashicorp__dependent_applications) | unique }}'
+      register: hashicorp__register_signature
+      changed_when: False
+      failed_when: hashicorp__register_signature.rc != 0
+      tags: [ 'role::hashicorp:verify' ]
+
+    - name: Check file signatures
+      ansible.builtin.shell: set -o nounset -o pipefail -o errexit &&
+             grep --file <(find . -type f -printf "%f$\n")
+             {{ item + '_' + hashicorp__combined_version_map[item] + '_' + hashicorp__hash_suffix }}
+             | sha256sum --check --status
+      args:
+        chdir: '{{ hashicorp__src + "/" + item + "/" + hashicorp__combined_version_map[item] }}'
+        executable: 'bash'
+      with_items: '{{ (hashicorp__applications + hashicorp__dependent_applications) | unique }}'
+      register: hashicorp__register_hash
+      changed_when: False
+      failed_when: hashicorp__register_hash.rc != 0
+      tags: [ 'role::hashicorp:verify' ]
+
+
+    # HashiCorp application archive unpack [[[2
+
+    - name: Unpack the file archives
+      ansible.builtin.unarchive:
+        remote_src: True
+        src: '{{ hashicorp__src + "/" + item + "/" + hashicorp__combined_version_map[item] + "/" +
+                 item + "_" + hashicorp__combined_version_map[item] + "_" + hashicorp__tar_suffix }}'
+        dest: '{{ hashicorp__lib + "/" + item + "/" + hashicorp__combined_version_map[item] }}'
+        mode: 'u=rwX,g=rwX,o=rX'
+        creates: '{{ hashicorp__lib + "/" + item + "/" + hashicorp__combined_version_map[item] + "/" +
+                     ((hashicorp__combined_binary_map[item]
+                       if hashicorp__combined_binary_map[item] is string
+                       else hashicorp__combined_binary_map[item] | first)
+                      if hashicorp__combined_binary_map[item] | d() else item) }}'
+      with_items: '{{ (hashicorp__applications + hashicorp__dependent_applications) | unique }}'
+      register: hashicorp__register_unpack
+      tags: [ 'role::hashicorp:unpack', 'role::hashicorp:install' ]
+
+    - name: Unpack the Consul Web UI
+      ansible.builtin.unarchive:
+        copy: False
+        src: '{{ hashicorp__src + "/" + item + "/" + hashicorp__combined_version_map[item] + "/" +
+                 item + "_" + hashicorp__combined_version_map[item] + "_" + hashicorp__consul_webui_suffix }}'
+        dest: '{{ hashicorp__lib + "/" + item + "/" + hashicorp__combined_version_map[item] + "/web_ui" + "/" }}'
+        mode: 'u=rwX,g=rwX,o=rX'
+        creates: '{{ hashicorp__lib + "/" + item + "/"
+                     + hashicorp__combined_version_map[item] + "/web_ui/index.html" }}'
+      with_items: '{{ (hashicorp__applications + hashicorp__dependent_applications) | unique }}'
+      register: hashicorp__register_unpack_webui
+      when: hashicorp__consul_webui | bool and item == 'consul'
+      tags: [ 'role::hashicorp:unpack', 'role::hashicorp:install' ]
+
+
+# HashiCorp application installation [[[1
+
+- name: Install HashiCorp applications
+  ansible.builtin.shell: install --mode 755 --owner root --group root --target-directory {{ hashicorp__bin }}
+         {{ ((hashicorp__combined_binary_map[item.0]
+              if hashicorp__combined_binary_map[item.0] is string
+              else hashicorp__combined_binary_map[item.0] | join(' '))
+             if hashicorp__combined_binary_map[item.0] | d() else item.0) }}
+         {% if item.0 == 'terraform' %}
+         ; find . -maxdepth 1 -type f -name 'terraform-*'
+                  -exec install -m 755 -o root -g root -t {{ hashicorp__bin }} {} +
+         {% endif %}
+  args:  # noqa no-handler
+    chdir: '{{ hashicorp__lib + "/" + item.0 + "/" + hashicorp__combined_version_map[item.0] }}'
+  with_together:
+    - '{{ (hashicorp__applications + hashicorp__dependent_applications) | unique }}'
+    - '{{ hashicorp__register_unpack.results }}'
+  register: hashicorp__register_app_install
+  changed_when: hashicorp__register_app_install.changed | bool
+  when: (item.1 is changed or (ansible_local | d() and
+         (ansible_local.hashicorp is not defined or
+          (ansible_local.hashicorp | d() and ansible_local.hashicorp.applications | d() and
+           (ansible_local.hashicorp.applications[item.0] is not defined or
+            (ansible_local.hashicorp.applications[item.0] != hashicorp__combined_version_map[item.0]))))))
+  tags: [ 'role::hashicorp:install' ]
+
+- name: Synchronize Consul Web UI public directory  # noqa command-instead-of-module
+  ansible.builtin.shell: 'rsync --delete --recursive --prune-empty-dirs
+         {{ hashicorp__lib + "/" + item + "/" + hashicorp__combined_version_map[item] + "/web_ui/" }}
+         {{ hashicorp__consul_webui_path }} && chown -R root:root {{ hashicorp__consul_webui_path }}'
+  with_items: '{{ (hashicorp__applications + hashicorp__dependent_applications) | unique }}'
+  register: hashicorp__register_consul_ui_rsync
+  changed_when: hashicorp__register_consul_ui_sync.changed | bool
+  when: (hashicorp__consul_webui | bool and item == 'consul' and hashicorp__register_unpack_webui is changed)
+
+
+# Ansible local facts [[[1
+
+- name: Make sure Ansible fact directory exists
+  ansible.builtin.file:
+    path: '/etc/ansible/facts.d'
+    state: 'directory'
+    owner: 'root'
+    group: 'root'
+    mode: '0755'
+  when: (hashicorp__applications or hashicorp__dependent_applications)
+
+- name: Save HashiCorp local facts
+  ansible.builtin.template:
+    src: 'etc/ansible/facts.d/hashicorp.fact.j2'
+    dest: '/etc/ansible/facts.d/hashicorp.fact'
+    owner: 'root'
+    group: 'root'
+    mode: '0644'
+  notify: [ 'Refresh host facts' ]
+  when: (hashicorp__applications or hashicorp__dependent_applications)
+  tags: [ 'meta::facts' ]
+
+- name: Reload facts if they were modified
+  ansible.builtin.meta: 'flush_handlers'

ansible_collections/debops/debops/roles/hashicorp/templates/etc/ansible/facts.d/hashicorp.fact.j2

@@ -0,0 +1,27 @@
+{# Copyright (C) 2016      Maciej Delmanowski <drybjed@gmail.com>
+ # Copyright (C) 2016-2017 DebOps <https://debops.org/>
+ # SPDX-License-Identifier: GPL-3.0-only
+ #}
+{% set hashicorp__tpl_application_list = ((ansible_local.hashicorp.applications | list if (ansible_local.hashicorp.applications | d()) else []) + hashicorp__applications + hashicorp__dependent_applications) | sort | unique %}
+{% set hashicorp__tpl_applications = {} %}
+{% for entry in hashicorp__tpl_application_list %}
+{%   if (ansible_local.hashicorp.applications | d() and entry in ansible_local.hashicorp.applications) %}
+{%     set _ = hashicorp__tpl_applications.update({ entry : ansible_local.hashicorp.applications[entry] }) %}
+{%   elif entry in hashicorp__combined_version_map %}
+{%     set _ = hashicorp__tpl_applications.update({ entry : hashicorp__combined_version_map[entry] }) %}
+{%   endif %}
+{%   if (entry in hashicorp__combined_version_map and (hashicorp__tpl_applications[entry] != hashicorp__combined_version_map[entry])) %}
+{%     set _ = hashicorp__tpl_applications.update({ entry : hashicorp__combined_version_map[entry] }) %}
+{%   endif %}
+{% endfor %}
+{% set hashicorp__tpl_consul_webui = ansible_local.hashicorp.consul_webui | d(False) | bool | lower %}
+{% if hashicorp__consul_webui | bool and 'consul' in hashicorp__tpl_applications %}
+{%   set hashicorp__tpl_consul_webui = True %}
+{% endif %}
+{% set hashicorp__tpl_facts = {} %}
+{% set _ = hashicorp__tpl_facts.update({ "applications":      hashicorp__tpl_applications }) %}
+{% set _ = hashicorp__tpl_facts.update({ "bin":               hashicorp__bin }) %}
+{% set _ = hashicorp__tpl_facts.update({ "consul_webui":      hashicorp__tpl_consul_webui | bool | lower }) %}
+{% set _ = hashicorp__tpl_facts.update({ "consul_webui_path": hashicorp__consul_webui_path }) %}
+{% set _ = hashicorp__tpl_facts.update({ "installed":         "true" }) %}
+{{ hashicorp__tpl_facts | to_nice_json }}