-
Notifications
You must be signed in to change notification settings - Fork 3
/
encrypt2each-member.yml
executable file
·69 lines (59 loc) · 1.99 KB
/
encrypt2each-member.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
#!/usr/bin/env ansible-playbook -e python_interpreter=/usr/local/bin/python3
---
# This converts vault.json unencrypted shards to Keybase encrypted.
# This enforces the Shamir Secret Sharing, after automating the unsealed Vault.
- name: Encrypt each vault.json unseal key to a Keybase Team member
hosts: localhost
connection: local
become: false
gather_facts: false
vars_files:
- defaults/main.yml
tasks:
- name: Load encrypted Vault credentials
no_log: true
include_vars: "{{ vault_credentials }}"
register: json
- name: Create arrays
set_fact:
pgp_unseal_keys_b64: []
pgp_unseal_keys_hex: []
- name: Encrypt unseal keys and encode base64
shell: |
set -o pipefail; \
keybase pgp encrypt -m {{ item.0 }} -b {{ item.1 }} | base64
with_together:
- "{{ json.ansible_facts.unseal_keys_hex }}"
- "{{ kbt }}"
register: b64
no_log: true
changed_when: false
- name: Encrypt unseal keys and encode hex
shell: |
set -o pipefail; \
keybase pgp encrypt -m {{ item.0 }} -b {{ item.1 }} | xxd -p
with_together:
- "{{ json.ansible_facts.unseal_keys_hex }}"
- "{{ kbt }}"
register: hex
no_log: true
changed_when: false
- name: Add to arrays
set_fact:
pgp_unseal_keys_b64: "{{ pgp_unseal_keys_b64 + [ item.0.stdout ] }}"
pgp_unseal_keys_hex: "{{ pgp_unseal_keys_hex + [ item.1.stdout ] }}"
with_together:
- "{{ b64.results }}"
- "{{ hex.results }}"
no_log: true
- name: Write vault.json file in KBFS
copy:
content: "{{ lookup('template', 'templates/vault.j2') | to_nice_json }}"
dest: "{{ vault_credentials }}"
- name: Encrypt vault.json with ansible-vault
no_log: true
environment:
ANSIBLE_VAULT_PASSWORD_FILE: "{{ ANSIBLE_VAULT_PASSWORD_FILE }}"
command: "ansible-vault encrypt {{ vault_credentials }}"
changed_when: true
...