tftsr_ai/templates/vault/vault-unseal.sh.j2

#!/bin/bash
# Vault auto-unseal script — managed by Ansible, do not edit manually
# Reads unseal key from /etc/vault.d/unseal.key and unseals Vault

set -e

VAULT_ADDR="http://127.0.0.1:{{ vault_port }}"
UNSEAL_KEY_FILE="/etc/vault.d/unseal.key"

if [ ! -f "$UNSEAL_KEY_FILE" ]; then
    echo "ERROR: unseal key not found at $UNSEAL_KEY_FILE"
    exit 1
fi

UNSEAL_KEY=$(cat "$UNSEAL_KEY_FILE")

if [ -z "$UNSEAL_KEY" ]; then
    echo "ERROR: unseal key file is empty"
    exit 1
fi

# Wait for Vault API to become ready (up to 60 s)
for i in $(seq 1 30); do
    STATUS=$(curl -sf "${VAULT_ADDR}/v1/sys/health" 2>/dev/null || true)
    if [ -n "$STATUS" ]; then
        SEALED=$(echo "$STATUS" | jq -r '.sealed')
        if [ "$SEALED" = "false" ]; then
            echo "Vault is already unsealed."
            exit 0
        fi
        break
    fi
    echo "Waiting for Vault API... ($i/30)"
    sleep 2
done

echo "Unsealing Vault..."
curl -sf -X PUT "${VAULT_ADDR}/v1/sys/unseal" \
    -H "Content-Type: application/json" \
    -d "{\"key\": \"${UNSEAL_KEY}\"}"
echo ""
echo "Vault unsealed successfully."