diff options
Diffstat (limited to 'ansible')
| -rw-r--r-- | ansible/inventory.yml | 14 | ||||
| -rwxr-xr-x | ansible/scripts/ansible-vault-password.sh | 3 | ||||
| -rwxr-xr-x | ansible/scripts/vault-keyring-client.py | 163 |
3 files changed, 180 insertions, 0 deletions
diff --git a/ansible/inventory.yml b/ansible/inventory.yml index 156368e..a92bcf8 100644 --- a/ansible/inventory.yml +++ b/ansible/inventory.yml @@ -3,8 +3,22 @@ ungrouped: pi-broughton: ansible_host: 192.168.178.91 ansible_ssh_user: broughton + ansible_become_password: !vault | + $ANSIBLE_VAULT;1.2;AES256;ansible + 37303430343230343630613466313966363364623237643761336130653863343666366137346139 + 6263313237366638623833306662626663646364623232390a326264333336353435653964343861 + 37626438343134636130646239653439303333363665343931373830613661366264316462393137 + 3438353664653365300a626535303539653166663665356563386234343161313738663534333033 + 6139 connection_device_name: eth0 blade-canongate: ansible_host: 192.168.178.75 ansible_ssh_user: canongate + ansible_become_password: !vault | + $ANSIBLE_VAULT;1.2;AES256;ansible + 38616635313066363236373162383131623435313763393535316435343462323530306530373436 + 6436663763386637366665313063386338363730633863630a326331316236633533376661373039 + 63326363386631313835306630336535616335336237663831613832663237396661363436643437 + 3237646663616430340a656137396337303564646333316234623264643963623162623766383131 + 6338 connection_device_name: eth0 diff --git a/ansible/scripts/ansible-vault-password.sh b/ansible/scripts/ansible-vault-password.sh new file mode 100755 index 0000000..af387bd --- /dev/null +++ b/ansible/scripts/ansible-vault-password.sh @@ -0,0 +1,3 @@ +#!/bin/sh + +secret-tool lookup key ansible-keyring-password diff --git a/ansible/scripts/vault-keyring-client.py b/ansible/scripts/vault-keyring-client.py new file mode 100755 index 0000000..a0e830f --- /dev/null +++ b/ansible/scripts/vault-keyring-client.py @@ -0,0 +1,163 @@ +#!/usr/bin/env python +# (c) 2014, Matt Martz <matt@sivel.net> +# (c) 2016, Justin Mayer <https://justinmayer.com/> +# +# GNU General Public License v3.0+ (see COPYING or https://www.gnu.org/licenses/gpl-3.0.txt) +# +# ============================================================================= +# +# This script is to be used with ansible-vault's --vault-id arg +# to retrieve the vault password via your OS's native keyring application. +# +# This file *MUST* be saved with executable permissions. Otherwise, Ansible +# will try to parse as a password file and display: "ERROR! Decryption failed" +# +# The `keyring` Python module is required: https://pypi.org/project/keyring/ +# +# By default, this script will store the specified password in the keyring of +# the user that invokes the script. To specify a user keyring, add a [vault] +# section to your ansible.cfg file with a 'username' option. Example: +# +# [vault] +# username = 'ansible-vault' +# +# In useage like: +# +# ansible-vault --vault-id keyring_id@contrib/vault/vault-keyring-client.py view some_encrypted_file +# +# --vault-id will call this script like: +# +# contrib/vault/vault-keyring-client.py --vault-id keyring_id +# +# That will retrieve the password from users keyring for the +# keyring service 'keyring_id'. The equivalent of: +# +# keyring get keyring_id $USER +# +# If no vault-id name is specified to ansible command line, the vault-keyring-client.py +# script will be called without a '--vault-id' and will default to the keyring service 'ansible' +# This is equivalent to: +# +# keyring get ansible $USER +# +# You can configure the `vault_password_file` option in ansible.cfg: +# +# [defaults] +# ... +# vault_password_file = /path/to/vault-keyring-client.py +# ... +# +# To set your password, `cd` to your project directory and run: +# +# # will use default keyring service / vault-id of 'ansible' +# /path/to/vault-keyring-client.py --set +# +# or to specify the keyring service / vault-id of 'my_ansible_secret': +# +# /path/to/vault-keyring-client.py --vault-id my_ansible_secret --set +# +# If you choose not to configure the path to `vault_password_file` in +# ansible.cfg, your `ansible-playbook` command might look like: +# +# ansible-playbook --vault-id=keyring_id@/path/to/vault-keyring-client.py site.yml + +from __future__ import absolute_import, division, print_function + +__metaclass__ = type + +import argparse +import getpass +import sys + +import keyring +from ansible.config.manager import ConfigManager, get_ini_config_value + +KEYNAME_UNKNOWN_RC = 2 + + +def build_arg_parser(): + parser = argparse.ArgumentParser( + description="Get a vault password from user keyring" + ) + + parser.add_argument( + "--vault-id", + action="store", + default=None, + dest="vault_id", + help="name of the vault secret to get from keyring", + ) + parser.add_argument( + "--username", + action="store", + default=None, + help="the username whose keyring is queried", + ) + parser.add_argument( + "--set", + action="store_true", + default=False, + dest="set_password", + help="set the password instead of getting it", + ) + return parser + + +def main(): + # Set default values + username = getpass.getuser() + keyname = "ansible" + + # Try to load values from config if one exists + config = ConfigManager() + if config._config_file: + username = ( + get_ini_config_value( + config._parsers[config._config_file], + dict(section="vault", key="username"), + ) + or username + ) + + keyname = ( + get_ini_config_value( + config._parsers[config._config_file], + dict(section="vault", key="keyname"), + ) + or keyname + ) + + # Read values from command line (which override the previous if given) + arg_parser = build_arg_parser() + args = arg_parser.parse_args() + + username = args.username or username + keyname = args.vault_id or keyname + + if args.set_password: + intro = 'Storing password in "{}" user keyring using key name: {}\n' + sys.stdout.write(intro.format(username, keyname)) + password = getpass.getpass() + confirm = getpass.getpass("Confirm password: ") + if password == confirm: + keyring.set_password(keyname, username, password) + else: + sys.stderr.write("Passwords do not match\n") + sys.exit(1) + else: + secret = keyring.get_password(keyname, username) + if secret is None: + sys.stderr.write( + 'vault-keyring-client could not find key="%s" for user="%s" via backend="%s"\n' + % (keyname, username, keyring.get_keyring().name) + ) + sys.exit(KEYNAME_UNKNOWN_RC) + + # print('secret: %s' % secret) + sys.stdout.write("%s\n" % secret) + + sys.exit(0) + + +if __name__ == "__main__": + main() |