Ansible Vault Password Management using gpg

decrypt-vault_pw.sh

#!/usr/bin/env bash
gpg --quiet --batch --use-agent --decrypt "${BASH_SOURCE%/*}/vault_pw.gpg"

encrypt-vault_pw.sh

#!/usr/bin/env bash
# Encrypt the vault password for all authorized admins

set -e

DECRYPTED_PW_FILE="${BASH_SOURCE%/*}/vault_pw"
ENCRYPTED_PW_FILE="${DECRYPTED_PW_FILE}.gpg"

declare -A ADMIN_KEYS
ADMIN_KEYS["0xC839DB1EC3F4BBA9F9BE7406E6CE0A10496C1733"]="Sebastian Endres <[email protected]>"

if [ ! -f "${DECRYPTED_PW_FILE}" ]; then
    if [ ! -f "${ENCRYPTED_PW_FILE}" ]; then
        echo "🗲 Neither the encrypted nor the decrypted password file exist."
        echo "  encrypted password file: ${ENCRYPTED_PW_FILE}"
        echo "  decrypted password file: ${DECRYPTED_PW_FILE}"
        exit 1
    fi

    echo "🛈 Decrypting password file"
    rm -f "${DECRYPTED_PW_FILE}"
    gpg --quiet --batch --use-agent --output "${DECRYPTED_PW_FILE}" --decrypt "${ENCRYPTED_PW_FILE}"
fi

echo "🛈 Encrypting password file for new recipients"
recipient_args=()
for key in "${!ADMIN_KEYS[@]}"; do
    echo "  → encrypting to '${ADMIN_KEYS[$key]}'"
    recipient_args+=("--recipient=${key}")
done

rm -f "${ENCRYPTED_PW_FILE}"
gpg --quiet --batch --use-agent --output "${ENCRYPTED_PW_FILE}" --always-trust "${recipient_args[@]}" --encrypt "${DECRYPTED_PW_FILE}"
rm -f "${DECRYPTED_PW_FILE}"