80 lines
2.2 KiB
Bash
Executable File
80 lines
2.2 KiB
Bash
Executable File
#!/usr/bin/env bash
|
||
set -euo pipefail
|
||
|
||
REPO_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
||
VAULT_FILE="${VAULT_FILE:-$REPO_DIR/secrets/vault.yml}"
|
||
VAULT_PASS_FILE="${VAULT_PASS_FILE:-$HOME/.config/vault-pass.txt}"
|
||
|
||
usage() {
|
||
cat <<EOF
|
||
用法:
|
||
scripts/vault.sh init 初始化 vault password file（若不存在）
|
||
scripts/vault.sh view 檢視加密檔內容
|
||
scripts/vault.sh edit 編輯加密檔內容
|
||
scripts/vault.sh encrypt FILE 將檔案加密成 ansible-vault 格式
|
||
scripts/vault.sh decrypt OUT 解密到指定輸出檔
|
||
scripts/vault.sh rekey 重新加密並更新 key
|
||
EOF
|
||
}
|
||
|
||
ensure_pass() {
|
||
mkdir -p "$(dirname "$VAULT_PASS_FILE")"
|
||
chmod 700 "$(dirname "$VAULT_PASS_FILE")" || true
|
||
if [ ! -f "$VAULT_PASS_FILE" ]; then
|
||
umask 177
|
||
python3 - <<'PY' > "$VAULT_PASS_FILE"
|
||
import secrets
|
||
print(secrets.token_urlsafe(48))
|
||
PY
|
||
chmod 600 "$VAULT_PASS_FILE"
|
||
echo "已建立 vault password file: $VAULT_PASS_FILE"
|
||
fi
|
||
}
|
||
|
||
cmd="${1:-}"
|
||
case "$cmd" in
|
||
init)
|
||
ensure_pass
|
||
;;
|
||
view)
|
||
ensure_pass
|
||
ansible-vault view "$VAULT_FILE" --vault-password-file "$VAULT_PASS_FILE"
|
||
;;
|
||
edit)
|
||
ensure_pass
|
||
[ -f "$VAULT_FILE" ] || { echo "找不到 $VAULT_FILE"; exit 1; }
|
||
ansible-vault edit "$VAULT_FILE" --vault-password-file "$VAULT_PASS_FILE"
|
||
;;
|
||
encrypt)
|
||
ensure_pass
|
||
src="${2:-}"
|
||
[ -n "$src" ] || { usage; exit 1; }
|
||
cp "$src" "$VAULT_FILE"
|
||
ansible-vault encrypt "$VAULT_FILE" --vault-password-file "$VAULT_PASS_FILE"
|
||
;;
|
||
decrypt)
|
||
ensure_pass
|
||
out="${2:-}"
|
||
[ -n "$out" ] || { usage; exit 1; }
|
||
ansible-vault decrypt "$VAULT_FILE" --output "$out" --vault-password-file "$VAULT_PASS_FILE"
|
||
chmod 600 "$out" || true
|
||
;;
|
||
rekey)
|
||
ensure_pass
|
||
tmp_new="$(mktemp)"
|
||
chmod 600 "$tmp_new"
|
||
python3 - <<'PY' > "$tmp_new"
|
||
import secrets
|
||
print(secrets.token_urlsafe(48))
|
||
PY
|
||
ansible-vault rekey "$VAULT_FILE" --vault-password-file "$VAULT_PASS_FILE" --new-vault-password-file "$tmp_new"
|
||
mv "$tmp_new" "$VAULT_PASS_FILE"
|
||
chmod 600 "$VAULT_PASS_FILE"
|
||
echo "已更新 vault key: $VAULT_PASS_FILE"
|
||
;;
|
||
*)
|
||
usage
|
||
exit 1
|
||
;;
|
||
esac
|