1 files changed, 15 insertions, 0 deletions
diff --git a/bin/rotate-vault-password b/bin/rotate-vault-password
new file mode 100755
index 0000000..1762786
--- /dev/null
+++ b/bin/rotate-vault-password
@@ -0,0 +1,15 @@
+#! /usr/bin/env sh
+
+head -c 128 /dev/urandom | base64 > password.txt
+
+ansible-vault rekey
+    --new-vault-password-file password.txt \
+    `git grep -l 'ANSIBLE_VAULT;1.1;AES256$'`
+
+gpg \
+  -r d@ilvokhin.com \
+  --armor \
+  --output misc/vault-password.asc \
+  --encrypt password.txt
+
+ansible-vault view misc/vaults/example.yml && rm password.txt