anchor.diff:  ###########################################################################################################
   # this file has been put in place by the jsok/vault Puppet module (https://forge.puppetlabs.com/jsok/vault)
   # any changes will be overwritten if Puppet is run again
  -# This script is originally from: https://github.com/mterron/init-scripts/blob/master/vault.service
  +# This script is originally from:
  +# https://learn.hashicorp.com/vault/operations/ops-deployment-guide#step-3-configure-systemd
   ###########################################################################################################
   
   [Unit]
  -Description=Vault server
  -Requires=basic.target network.target
  -After=basic.target network.target
  +Description="HashiCorp Vault - A tool for managing secrets"
  +Documentation=https://www.vaultproject.io/docs/
  +Requires=network-online.target
  +After=network-online.target
  +ConditionFileNotEmpty=<%= scope['vault::config_dir'] %>/config.json
   
   [Service]
   User=<%= scope['vault::user'] %>
  
positive.code: Restart=on-failure
  StartLimitInterval=60s
  StartLimitBurst=3
  
  [Install]
  WantedBy=multi-user.target
  
negative.code: <% # Still require check for :undef for Puppet 3.x -%>
  <% if scope['vault::disable_mlock'] && scope['vault::disable_mlock'] != :undef -%>
  CapabilityBoundingSet=CAP_SYSLOG
  <% else -%>
  SecureBits=keep-caps
  Capabilities=CAP_IPC_LOCK+ep
  CapabilityBoundingSet=CAP_SYSLOG CAP_IPC_LOCK
  <% end -%>
  NoNewPrivileges=yes
  Environment=GOMAXPROCS=<%= scope['vault::num_procs'] %>
  ExecStart=<%= scope['vault::bin_dir'] %>/vault server -config=<%= scope['vault::config_dir'] %>/config.json <%= scope['vault::service_options'] %>
  KillSignal=SIGINT
  