---
- name: deploy acl bootstrap
  sudo: yes
  when: consul_dc == consul_acl_datacenter
  copy:
    src: consul-acl-bootstrap.sh
    dest: /usr/local/bin
    mode: 0700
  tags:
    - consul
    - acl

- name: upsert agent acl
  sudo: yes
  when: consul_dc == consul_acl_datacenter
  run_once: yes
  command: /usr/local/bin/consul-acl-bootstrap.sh {{ consul_acl_master_token }} {{ consul_acl_agent_token }}
  tags:
    - consul
    - acl

- name: create agent_acl consul config
  sudo: yes
  template:
    src: agent_acl.json.j2
    dest: /etc/consul/agent_acl.json
  notify:
    - restart consul
  tags:
    - consul

- meta: flush_handlers

- name: set default policy to deny
  sudo: yes
  replace:
    dest: /etc/consul/acl.json
    regexp: '"acl_default_policy": "allow"'
    replace: '"acl_default_policy": "{{ consul_acl_default_policy }}"'
  tags:
    - consul
  notify:
    - restart consul
