anchor.diff:  <% # Still require check for :undef for Puppet 3.x -%>
   <% if scope['vault::disable_mlock'] && scope['vault::disable_mlock'] != :undef -%>
   CapabilityBoundingSet=CAP_SYSLOG
  -NoNewPrivileges=yes
   <% else -%>
   SecureBits=keep-caps
   Capabilities=CAP_IPC_LOCK+ep
   CapabilityBoundingSet=CAP_SYSLOG CAP_IPC_LOCK
  +<% end -%>
   NoNewPrivileges=yes
  -<% end -%>
   Environment=GOMAXPROCS=<%= scope['vault::num_procs'] %>
   ExecStart=<%= scope['vault::bin_dir'] %>/vault server -config=<%= scope['vault::config_dir'] %>/config.json <%= scope['vault::service_options'] %>
   KillSignal=SIGINT
  
positive.code: ###########################################################################################################
  # this file has been put in place by the jsok/vault Puppet module (https://forge.puppetlabs.com/jsok/vault)
  # any changes will be overwritten if Puppet is run again
  # This script is originally from: https://github.com/mterron/init-scripts/blob/master/vault.service
  ###########################################################################################################
  
  [Unit]
  Description=Vault server
  Requires=basic.target network.target
  After=basic.target network.target
  
  [Service]
  User=<%= scope['vault::user'] %>
  
negative.code: Restart=on-failure
  StartLimitInterval=60s
  StartLimitBurst=3
  AmbientCapabilities=CAP_IPC_LOCK
  ExecReload=/bin/kill --signal HUP $MAINPID
  KillMode=process
  RestartSec=5
  TimeoutStopSec=30
  LimitNOFILE=65536
  
  [Install]
  WantedBy=multi-user.target
  