From 0ca8a9aed268956699582f1e8e6262f4aadea329 Mon Sep 17 00:00:00 2001
From: "Alice (OpenClaw)" <alice@cowbay.org>
Date: Thu, 6 Aug 2026 15:26:11 +0800
Subject: [PATCH] chore: convert vault.yml from age to ansible-vault encryption

- vault.yml was age-encrypted but scripts use ansible-vault commands
- Converted to ansible-vault format so vault.sh and get-secret.sh work
- Added encryption format change log to docs/secret-vault.md
- Verified: vault.sh view and get-secret.sh both working
---
 docs/secret-vault.md | 27 +++++++++++++++++++++++++++
 secrets/vault.yml    | 19 ++++++++++++++-----
 2 files changed, 41 insertions(+), 5 deletions(-)

diff --git a/docs/secret-vault.md b/docs/secret-vault.md
index 85e3ec7..e8f75cf 100644
--- a/docs/secret-vault.md
+++ b/docs/secret-vault.md
@@ -12,6 +12,33 @@
 - `vault-pass.txt` 只放在本機，不進 git
 - 解密後的暫存 plaintext 檔不要提交
 
+## 加密格式變更紀錄
+
+### 2026-08-06：從 age 轉換為 ansible-vault
+
+**原因**：repo 內的 scripts（`vault.sh`、`get-secret.sh`）全部使用 `ansible-vault` 命令，但 `vault.yml` 原本是 age 加密格式，導致 scripts 無法正常解密。
+
+**問題**：
+- age 加密的 vault.yml 開頭為 `age-encryption.org/v1`
+- ansible-vault 加密的 vault.yml 開頭為 `$ANSIBLE_VAULT;1.1;AES256`
+- 兩者格式不相容，ansible-vault 無法解密 age 格式的檔案
+
+**修改內容**：
+1. 使用 age 私鑰（`~/.config/openclaw/age.key`）解密 vault.yml
+2. 使用 ansible-vault + vault-pass.txt 重新加密 vault.yml
+3. 驗證 `vault.sh view` 和 `get-secret.sh` 正常運作
+
+**驗證結果**：
+```bash
+./scripts/vault.sh view                           # ✅ 正常顯示 vault 內容
+./scripts/get-secret.sh http_nodes.bynara.base_url  # ✅ 正常讀取單一 secret
+```
+
+**影響**：
+- vault.yml 現在使用 ansible-vault 格式，所有 scripts 可直接使用
+- age 私鑰不再需要（除非未來有其他 age 加密需求）
+- vault password file（`~/.config/vault-pass.txt`）仍然是唯一的解密鑰匙
+
 ## 常用指令
 初始化：
 ```bash
diff --git a/secrets/vault.yml b/secrets/vault.yml
index 6ac22e8..ba0796c 100644
--- a/secrets/vault.yml
+++ b/secrets/vault.yml
@@ -1,5 +1,14 @@
-age-encryption.org/v1
--> X25519 a7BFvW8O4ym7K2fN/BMv7JiV+9iS1Tskb00yvfnzJEM
-yaap5PV+NYcVZ+gwlaWCbi1NFZ8OCJtha7ZGu/J5JGs
---- 4mxICGRpvAEL1gRxqTxRC60I6SRzYwBQ9cNye2cyDWA
-ד�q����y ?�^�P&&��
���L����~��X7%f��宛i�?��$8�P��k�l��E�ƽ��<-"���L-�/O��W��S+F�'||����ۅ�XiA/5O+��vf�6��A+g��9�|K�`V�J���U�Obd�ݦ��)�����p�e��+�U�2j�A��8S���uj���sՊ	Ϻ��u}�A�Y�����謖
\ No newline at end of file
+$ANSIBLE_VAULT;1.1;AES256
+65303563323765626666626635303734353761383435333337623833316564363363663666363261
+3133363638383761303531303432316438333734366231390a303039653336633836303338333766
+32323437623635313363623730383562626464346333666437656466633832663663303236623138
+6265663332386261650a326262396334643237626238643334356562666330313139386665343931
+32616663306336376131396633626139326663623435626161643364626239303432653135386439
+32656530353332326466663534373765333531383137623032343831363264636162663463626261
+33633062333463616137353564353535366135643666643730326264393039663966306635333962
+34323538663464633832633332653735353434626636393834346437613437646435333062353330
+62633463316432363131313532376338633661373133393136363232653636386465666464316537
+39313430636138376537643665643735393838306636363337356562363334383632656331666163
+64636337613531343364313234326137336239306631366531633232383262623364343936643164
+30373336653239613130613439303464393937626462633665303866323638636530633930336465
+62653662373533643533666662393632366263333239623933646662646665663465