From 2822b40326df4c24042b879a64389ce5e594fa5b Mon Sep 17 00:00:00 2001 From: Dmitry Ilvokhin Date: Sat, 20 Jan 2024 17:52:30 +0000 Subject: Prepare to store encrypted secrets in the repo --- bin/decrypt-vault-password.sh | 3 +++ bin/rotate-vault-password.sh | 15 +++++++++++++++ 2 files changed, 18 insertions(+) create mode 100755 bin/decrypt-vault-password.sh create mode 100644 bin/rotate-vault-password.sh (limited to 'bin') diff --git a/bin/decrypt-vault-password.sh b/bin/decrypt-vault-password.sh new file mode 100755 index 0000000..e82de62 --- /dev/null +++ b/bin/decrypt-vault-password.sh @@ -0,0 +1,3 @@ +#! /usr/bin/env sh + +gpg --decrypt --batch --quiet --use-agent misc/vault-password.asc diff --git a/bin/rotate-vault-password.sh b/bin/rotate-vault-password.sh new file mode 100644 index 0000000..1762786 --- /dev/null +++ b/bin/rotate-vault-password.sh @@ -0,0 +1,15 @@ +#! /usr/bin/env sh + +head -c 128 /dev/urandom | base64 > password.txt + +ansible-vault rekey + --new-vault-password-file password.txt \ + `git grep -l 'ANSIBLE_VAULT;1.1;AES256$'` + +gpg \ + -r d@ilvokhin.com \ + --armor \ + --output misc/vault-password.asc \ + --encrypt password.txt + +ansible-vault view misc/vaults/example.yml && rm password.txt -- cgit v1.2.3-70-g09d2