56 lines
1015 B
Markdown
56 lines
1015 B
Markdown
# Secret Vault
|
||
|
||
這個 repo 使用 `ansible-vault` 來保存開發過程中需要的機密資訊。
|
||
|
||
## 設計
|
||
- 加密檔：`secrets/vault.yml`
|
||
- 本機 vault password file：`~/.config/vault-pass.txt`
|
||
- 管理腳本：`scripts/vault.sh`
|
||
|
||
## 原則
|
||
- 加密後的 `secrets/vault.yml` 可以進 git
|
||
- `vault-pass.txt` 只放在本機，不進 git
|
||
- 解密後的暫存 plaintext 檔不要提交
|
||
|
||
## 常用指令
|
||
初始化：
|
||
```bash
|
||
./scripts/vault.sh init
|
||
```
|
||
|
||
檢視：
|
||
```bash
|
||
./scripts/vault.sh view
|
||
```
|
||
|
||
編輯：
|
||
```bash
|
||
./scripts/vault.sh edit
|
||
```
|
||
|
||
把一份 plaintext YAML 加密成 vault：
|
||
```bash
|
||
./scripts/vault.sh encrypt /tmp/my-secrets.yml
|
||
```
|
||
|
||
解密到暫存檔：
|
||
```bash
|
||
./scripts/vault.sh decrypt /tmp/vault.yml
|
||
```
|
||
|
||
重置 vault key：
|
||
```bash
|
||
./scripts/vault.sh rekey
|
||
```
|
||
|
||
## 建議格式
|
||
```yaml
|
||
gitea:
|
||
base_url: https://gitea.cowbay.org
|
||
ssh_url_template: ssh://git@gitea.cowbay.org:2203/{owner}/{repo}.git
|
||
account: hermes
|
||
email: hermes@ntu.edu.rs
|
||
password: ...
|
||
api_token: ...
|
||
```
|