Add/refactor encrytion- and decryption scripts.
This commit is contained in:
Executable
+203
@@ -0,0 +1,203 @@
|
|||||||
|
#!/usr/bin/env bash
|
||||||
|
#
|
||||||
|
# decrypt-interactiv.sh
|
||||||
|
#
|
||||||
|
# Zweck:
|
||||||
|
# - Entschluesselt entweder:
|
||||||
|
# (A) eine komplett mit ansible-vault verschluesselte Datei (ANSIBLE_VAULT Header)
|
||||||
|
# (B) einzelne YAML "!vault |" Bloecke in einer Datei (z.B. group_vars/host_vars)
|
||||||
|
# (C) einen einzelnen verschluesselten String (Argument, Pipe oder interaktiv)
|
||||||
|
#
|
||||||
|
# Passwort wird einmalig interaktiv abgefragt.
|
||||||
|
#
|
||||||
|
|
||||||
|
set -euo pipefail
|
||||||
|
|
||||||
|
# Temporare Datei fuer das einmalig abgefragte Vault-Passwort.
|
||||||
|
VAULT_PASS_FILE=""
|
||||||
|
|
||||||
|
cleanup() {
|
||||||
|
# Sicherheitsnetz: Temp-Datei immer entfernen, auch bei Fehler/Abbruch.
|
||||||
|
if [[ -n "${VAULT_PASS_FILE}" && -f "${VAULT_PASS_FILE}" ]]; then
|
||||||
|
rm -f "${VAULT_PASS_FILE}"
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
ask_vault_password_once() {
|
||||||
|
# Passwort nur einmal pro Lauf abfragen und danach wiederverwenden.
|
||||||
|
if [[ -n "${VAULT_PASS_FILE}" && -f "${VAULT_PASS_FILE}" ]]; then
|
||||||
|
return 0
|
||||||
|
fi
|
||||||
|
|
||||||
|
if [[ ! -r /dev/tty ]]; then
|
||||||
|
echo "Error: No interactive TTY available for password prompt." >&2
|
||||||
|
return 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
local pw1=""
|
||||||
|
|
||||||
|
# Wichtig: Passwort direkt vom Terminal lesen, nicht von stdin.
|
||||||
|
read -rsp "Vault password: " pw1 < /dev/tty
|
||||||
|
printf '\n' > /dev/tty
|
||||||
|
|
||||||
|
if [[ -z "${pw1}" ]]; then
|
||||||
|
echo "Error: Empty password is not allowed." >&2
|
||||||
|
return 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Passwort in Datei speichern, damit ansible-vault es nicht interaktiv erwartet.
|
||||||
|
VAULT_PASS_FILE="$(mktemp)"
|
||||||
|
chmod 600 "${VAULT_PASS_FILE}"
|
||||||
|
printf '%s' "${pw1}" > "${VAULT_PASS_FILE}"
|
||||||
|
|
||||||
|
unset pw1
|
||||||
|
}
|
||||||
|
|
||||||
|
decrypt_with_prompted_password() {
|
||||||
|
# Alle decrypt-Aufrufe laufen zentral ueber diese Funktion.
|
||||||
|
ask_vault_password_once
|
||||||
|
ansible-vault decrypt --vault-password-file "${VAULT_PASS_FILE}" "$@" 2>/dev/null
|
||||||
|
}
|
||||||
|
|
||||||
|
########################################
|
||||||
|
# Hilfe anzeigen
|
||||||
|
########################################
|
||||||
|
show_help() {
|
||||||
|
cat <<EOF
|
||||||
|
Usage:
|
||||||
|
$(basename "$0") [OPTION] [INPUT]
|
||||||
|
|
||||||
|
Decrypt modes:
|
||||||
|
|
||||||
|
1) Full vault-encrypted file (ANSIBLE_VAULT header):
|
||||||
|
$(basename "$0") secrets.vault
|
||||||
|
|
||||||
|
2) YAML file containing one or multiple "!vault |" blocks:
|
||||||
|
$(basename "$0") group_vars/all.yml
|
||||||
|
|
||||||
|
3) Encrypted vault string:
|
||||||
|
$(basename "$0") 'secret: !vault | \$ANSIBLE_VAULT;1.1;AES256 ...'
|
||||||
|
echo 'secret: !vault | ...' | $(basename "$0")
|
||||||
|
|
||||||
|
4) Interactive mode (paste, then Ctrl-D):
|
||||||
|
$(basename "$0")
|
||||||
|
|
||||||
|
Options:
|
||||||
|
-h, --help Show this help and exit
|
||||||
|
|
||||||
|
Notes:
|
||||||
|
- This script prints decrypted values to stdout.
|
||||||
|
- Vault password is prompted once per script run.
|
||||||
|
EOF
|
||||||
|
}
|
||||||
|
|
||||||
|
########################################
|
||||||
|
# Hauptfunktion
|
||||||
|
########################################
|
||||||
|
vdecr() {
|
||||||
|
unset IFS
|
||||||
|
|
||||||
|
if [[ "${1:-}" == "-h" || "${1:-}" == "--help" ]]; then
|
||||||
|
show_help
|
||||||
|
return 0
|
||||||
|
fi
|
||||||
|
|
||||||
|
if ! command -v ansible-vault >/dev/null 2>&1; then
|
||||||
|
echo "Error: ansible-vault not found in PATH." >&2
|
||||||
|
return 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
########################################
|
||||||
|
# Wenn ein Argument uebergeben wurde
|
||||||
|
########################################
|
||||||
|
if [[ -n "${1:-}" ]]; then
|
||||||
|
|
||||||
|
# --- Fall 1: Argument ist eine Datei ---
|
||||||
|
if [[ -f "$1" ]]; then
|
||||||
|
|
||||||
|
if [[ "$(head -n1 "$1")" == "\$ANSIBLE_VAULT;1.1;AES256" ]]; then
|
||||||
|
decrypt_with_prompted_password "$1"
|
||||||
|
return 0
|
||||||
|
fi
|
||||||
|
|
||||||
|
printf 'Reading vault values from file...\n\n'
|
||||||
|
|
||||||
|
local parsing=0
|
||||||
|
local result=""
|
||||||
|
local name=""
|
||||||
|
|
||||||
|
local blue
|
||||||
|
local discard
|
||||||
|
blue="$(tput setaf 4 || true)"
|
||||||
|
discard="$(tput sgr0 || true)"
|
||||||
|
|
||||||
|
# Best-effort Parsing: Datei wird in Tokens zerlegt und !vault-Bloecke
|
||||||
|
# werden gesammelt, dann rekursiv als Stringinput entschluesselt.
|
||||||
|
while IFS= read -r token; do
|
||||||
|
|
||||||
|
if [[ "$(echo "$token" | grep -c "\!vault")" -gt 0 ]] && [[ $parsing -eq 0 ]]; then
|
||||||
|
parsing=1
|
||||||
|
|
||||||
|
elif [[ $parsing -eq 1 ]] && [[ "$(echo "$token" | grep -c ":")" -eq 0 ]]; then
|
||||||
|
result="$(printf "%s\n%s" "$result" "$token")"
|
||||||
|
|
||||||
|
else
|
||||||
|
if [[ -n "$result" ]]; then
|
||||||
|
printf "\n\n%s%s%s\n" "$blue" "$name" "$discard"
|
||||||
|
printf "%s" "$result" | vdecr
|
||||||
|
name=""
|
||||||
|
result=""
|
||||||
|
parsing=0
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
|
||||||
|
if [[ "$(echo "$token" | grep -c ":")" -eq 1 ]]; then
|
||||||
|
name="$token"
|
||||||
|
fi
|
||||||
|
|
||||||
|
done < <(tr -s '[:space:]' '\n' < "$1")
|
||||||
|
|
||||||
|
return 0
|
||||||
|
fi
|
||||||
|
|
||||||
|
# --- Fall 3: Argument ist ein String ---
|
||||||
|
local str="$1"
|
||||||
|
|
||||||
|
# --- Fall 4: String kommt per Pipe (stdin ist kein TTY) ---
|
||||||
|
elif [[ ! -t 0 ]]; then
|
||||||
|
local str
|
||||||
|
str="$(cat)"
|
||||||
|
|
||||||
|
# --- Fall 5: Interaktiv ---
|
||||||
|
else
|
||||||
|
printf 'Interactive mode. Paste encrypted string and press Ctrl-D two times to confirm.\n'
|
||||||
|
local str
|
||||||
|
str="$(cat)"
|
||||||
|
printf '\n'
|
||||||
|
fi
|
||||||
|
|
||||||
|
########################################
|
||||||
|
# String entschluesseln
|
||||||
|
########################################
|
||||||
|
# YAML-Deko entfernen und den Ciphertext in ein Format bringen,
|
||||||
|
# das ansible-vault decrypt direkt verarbeiten kann.
|
||||||
|
printf -- "%s" "$str" | \
|
||||||
|
sed 's/ /\n/g' | \
|
||||||
|
sed '/---\|^.*:\|\!vault\||\|^$/d' | \
|
||||||
|
decrypt_with_prompted_password
|
||||||
|
|
||||||
|
printf '\n'
|
||||||
|
}
|
||||||
|
|
||||||
|
# Aufraeumen erfolgt automatisch beim Verlassen des Skripts.
|
||||||
|
trap cleanup EXIT
|
||||||
|
|
||||||
|
########################################
|
||||||
|
# Main
|
||||||
|
########################################
|
||||||
|
if [[ "${1:-}" == "-h" || "${1:-}" == "--help" ]]; then
|
||||||
|
show_help
|
||||||
|
exit 0
|
||||||
|
fi
|
||||||
|
|
||||||
|
vdecr "${1:-}"
|
||||||
Executable
+184
@@ -0,0 +1,184 @@
|
|||||||
|
#!/usr/bin/env bash
|
||||||
|
#
|
||||||
|
# decrypt-vault-strings-from-file.sh
|
||||||
|
#
|
||||||
|
# Zweck:
|
||||||
|
# - Entschlüsselt entweder:
|
||||||
|
# (A) eine komplett mit ansible-vault verschlüsselte Datei (ANSIBLE_VAULT Header)
|
||||||
|
# (B) einzelne YAML "!vault |" Blöcke in einer Datei (z.B. group_vars/host_vars)
|
||||||
|
# (C) einen einzelnen verschlüsselten String (Argument, Pipe oder interaktiv)
|
||||||
|
#
|
||||||
|
# Erwartet eine Vault-Passwortdatei unter: ~/.vault-pass
|
||||||
|
#
|
||||||
|
|
||||||
|
set -euo pipefail
|
||||||
|
|
||||||
|
########################################
|
||||||
|
# Hilfe anzeigen
|
||||||
|
########################################
|
||||||
|
show_help() {
|
||||||
|
cat <<EOF
|
||||||
|
Usage:
|
||||||
|
$(basename "$0") [OPTION] [INPUT]
|
||||||
|
|
||||||
|
Decrypt modes:
|
||||||
|
|
||||||
|
1) Full vault-encrypted file (ANSIBLE_VAULT header):
|
||||||
|
$(basename "$0") secrets.vault
|
||||||
|
|
||||||
|
2) YAML file containing one or multiple "!vault |" blocks:
|
||||||
|
$(basename "$0") group_vars/all.yml
|
||||||
|
|
||||||
|
3) Encrypted vault string:
|
||||||
|
$(basename "$0") 'secret: !vault | \$ANSIBLE_VAULT;1.1;AES256 ...'
|
||||||
|
echo 'secret: !vault | ...' | $(basename "$0")
|
||||||
|
|
||||||
|
4) Interactive mode (paste, then Ctrl-D):
|
||||||
|
$(basename "$0")
|
||||||
|
|
||||||
|
Options:
|
||||||
|
-h, --help Show this help and exit
|
||||||
|
|
||||||
|
Notes:
|
||||||
|
- This script prints decrypted values to stdout.
|
||||||
|
EOF
|
||||||
|
}
|
||||||
|
|
||||||
|
########################################
|
||||||
|
# Hauptfunktion
|
||||||
|
########################################
|
||||||
|
vdecr() {
|
||||||
|
unset IFS
|
||||||
|
|
||||||
|
# --- Help Flag innerhalb der Funktion (falls rekursiv aufgerufen) ---
|
||||||
|
if [[ "${1:-}" == "-h" || "${1:-}" == "--help" ]]; then
|
||||||
|
show_help
|
||||||
|
return 0
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Prüfen ob ansible-vault existiert
|
||||||
|
if ! command -v ansible-vault >/dev/null 2>&1; then
|
||||||
|
echo "Error: ansible-vault not found in PATH." >&2
|
||||||
|
return 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
########################################
|
||||||
|
# Wenn ein Argument übergeben wurde
|
||||||
|
########################################
|
||||||
|
if [[ -n "${1:-}" ]]; then
|
||||||
|
|
||||||
|
# --- Fall 1: Argument ist eine Datei ---
|
||||||
|
if [[ -f "$1" ]]; then
|
||||||
|
|
||||||
|
# Wenn Datei eine "komplett verschlüsselte" Vault-Datei ist
|
||||||
|
# (Header ist die erste Zeile)
|
||||||
|
if [[ "$(head -n1 "$1")" == "\$ANSIBLE_VAULT;1.1;AES256" ]]; then
|
||||||
|
# Vollständige Datei entschlüsseln und ausgeben
|
||||||
|
ansible-vault decrypt "$1" 2>/dev/null
|
||||||
|
echo "Decrypted file: $1" >&2
|
||||||
|
return 0
|
||||||
|
fi
|
||||||
|
|
||||||
|
# --- Fall 2: Datei enthält einzelne "!vault" Blöcke (z.B. YAML) ---
|
||||||
|
printf 'Reading vault values from file...\n\n'
|
||||||
|
|
||||||
|
# parsing = 0 -> wir sind nicht im Vault-Block
|
||||||
|
# parsing = 1 -> wir sammeln gerade Vault-Block-Zeilen
|
||||||
|
local parsing=0
|
||||||
|
local result=""
|
||||||
|
local name=""
|
||||||
|
|
||||||
|
# Farbausgabe (blau) für den jeweiligen Key/Name
|
||||||
|
local blue
|
||||||
|
local discard
|
||||||
|
blue="$(tput setaf 4 || true)"
|
||||||
|
discard="$(tput sgr0 || true)"
|
||||||
|
|
||||||
|
# Originalscript hat "for line in \$(cat file)" verwendet,
|
||||||
|
# was nach Whitespace tokenisiert. Um das Verhalten kontrollierter
|
||||||
|
# beizubehalten, tokenisieren wir hier ebenfalls nach Whitespace:
|
||||||
|
#
|
||||||
|
# - Das hilft, wenn Vault-Blöcke eingerückt sind oder YAML Zeichen enthält,
|
||||||
|
# weil später ohnehin per sed weiter "normalisiert" wird.
|
||||||
|
#
|
||||||
|
# WICHTIG: Das ist nicht "echtes" YAML-Parsing, sondern best-effort.
|
||||||
|
while IFS= read -r token; do
|
||||||
|
|
||||||
|
# Start eines vault blocks erkennen (Token enthält "!vault")
|
||||||
|
if [[ "$(echo "$token" | grep -c "\!vault")" -gt 0 ]] && [[ $parsing -eq 0 ]]; then
|
||||||
|
parsing=1
|
||||||
|
|
||||||
|
# Im Vault-Block: Token ohne ":" werden gesammelt (Ciphertext-Zeilen)
|
||||||
|
elif [[ $parsing -eq 1 ]] && [[ "$(echo "$token" | grep -c ":")" -eq 0 ]]; then
|
||||||
|
result="$(printf "%s\n%s" "$result" "$token")"
|
||||||
|
|
||||||
|
# Sonst: Blockende / neuer Bereich
|
||||||
|
else
|
||||||
|
# Wenn wir einen gesammelten Block haben -> ausgeben und decrypten
|
||||||
|
if [[ -n "$result" ]]; then
|
||||||
|
printf "\n\n%s%s%s\n" "$blue" "$name" "$discard"
|
||||||
|
# Rekursiver Aufruf: der gesammelte Block wird wie "Stringinput"
|
||||||
|
# behandelt und im unteren Abschnitt entschlüsselt
|
||||||
|
printf "%s" "$result" | vdecr
|
||||||
|
name=""
|
||||||
|
result=""
|
||||||
|
parsing=0
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Token mit ":" als "Name" merken (typischerweise YAML key:)
|
||||||
|
if [[ "$(echo "$token" | grep -c ":")" -eq 1 ]]; then
|
||||||
|
name="$token"
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Tokenisierung nach Whitespace (ähnlich dem Original)
|
||||||
|
done < <(tr -s '[:space:]' '\n' < "$1")
|
||||||
|
|
||||||
|
echo "Processed vault values from file: $1" >&2
|
||||||
|
|
||||||
|
return 0
|
||||||
|
fi
|
||||||
|
|
||||||
|
# --- Fall 3: Argument ist ein String ---
|
||||||
|
local str="$1"
|
||||||
|
|
||||||
|
# --- Fall 4: String kommt per Pipe (stdin ist kein TTY) ---
|
||||||
|
elif [[ ! -t 0 ]]; then
|
||||||
|
local str
|
||||||
|
str="$(cat)"
|
||||||
|
|
||||||
|
# --- Fall 5: Interaktiv ---
|
||||||
|
else
|
||||||
|
printf 'Interactive mode. Paste encrypted string and press Ctrl-D two times to confirm.\n'
|
||||||
|
local str
|
||||||
|
str="$(cat)"
|
||||||
|
printf '\n'
|
||||||
|
fi
|
||||||
|
|
||||||
|
########################################
|
||||||
|
# String entschlüsseln
|
||||||
|
#
|
||||||
|
# Das Script erwartet, dass der Input evtl. als YAML-Fragment kommt,
|
||||||
|
# und "normalisiert" ihn so, dass ansible-vault decrypt damit klarkommt:
|
||||||
|
#
|
||||||
|
# - ersetzt Spaces durch Newlines
|
||||||
|
# - entfernt YAML-Deko wie "---", "key:", "!vault", "|", leere Zeilen
|
||||||
|
# - piped den Rest in "ansible-vault decrypt"
|
||||||
|
########################################
|
||||||
|
printf -- "%s" "$str" | \
|
||||||
|
sed 's/ /\n/g' | \
|
||||||
|
sed '/---\|^.*:\|\!vault\||\|^$/d' | \
|
||||||
|
ansible-vault decrypt 2>/dev/null
|
||||||
|
|
||||||
|
printf '\n'
|
||||||
|
}
|
||||||
|
|
||||||
|
########################################
|
||||||
|
# Main
|
||||||
|
########################################
|
||||||
|
if [[ "${1:-}" == "-h" || "${1:-}" == "--help" ]]; then
|
||||||
|
show_help
|
||||||
|
exit 0
|
||||||
|
fi
|
||||||
|
|
||||||
|
vdecr "${1:-}"
|
||||||
Executable
+244
@@ -0,0 +1,244 @@
|
|||||||
|
#!/usr/bin/env bash
|
||||||
|
#
|
||||||
|
# encrypt-interactiv.sh
|
||||||
|
#
|
||||||
|
# Zweck:
|
||||||
|
# - Verschluesselt entweder:
|
||||||
|
# (A) ein komplettes File mit ansible-vault encrypt
|
||||||
|
# (B) YAML key: value Zeilen als key: !vault | Block
|
||||||
|
# (C) einen einzelnen String (Argument, Pipe oder interaktiv)
|
||||||
|
#
|
||||||
|
# Passwort wird einmalig interaktiv abgefragt.
|
||||||
|
#
|
||||||
|
|
||||||
|
set -euo pipefail
|
||||||
|
|
||||||
|
# Temp-Datei fuer das einmalig abgefragte Passwort.
|
||||||
|
VAULT_PASS_FILE=""
|
||||||
|
# Vault-ID fuer Encrypt-Operationen (bei Bedarf per ENV ueberschreibbar).
|
||||||
|
VAULT_ID_LABEL="${VAULT_ID_LABEL:-default}"
|
||||||
|
|
||||||
|
cleanup() {
|
||||||
|
# Temp-Datei immer entfernen, auch bei Fehler/Abbruch.
|
||||||
|
if [[ -n "${VAULT_PASS_FILE}" && -f "${VAULT_PASS_FILE}" ]]; then
|
||||||
|
rm -f "${VAULT_PASS_FILE}"
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
ask_vault_password_once() {
|
||||||
|
# Passwort nur einmal pro Skriptlauf abfragen.
|
||||||
|
if [[ -n "${VAULT_PASS_FILE}" && -f "${VAULT_PASS_FILE}" ]]; then
|
||||||
|
return 0
|
||||||
|
fi
|
||||||
|
|
||||||
|
if [[ ! -r /dev/tty ]]; then
|
||||||
|
echo "Error: No interactive TTY available for password prompt." >&2
|
||||||
|
return 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
local pw1=""
|
||||||
|
local pw2=""
|
||||||
|
|
||||||
|
# Wichtig: Passwort immer direkt vom Terminal lesen,
|
||||||
|
# nicht von stdin (stdin kann String/Pipe-Daten enthalten).
|
||||||
|
read -rsp "Vault password: " pw1 < /dev/tty
|
||||||
|
printf '\n' > /dev/tty
|
||||||
|
read -rsp "Confirm password: " pw2 < /dev/tty
|
||||||
|
printf '\n' > /dev/tty
|
||||||
|
|
||||||
|
if [[ -z "${pw1}" ]]; then
|
||||||
|
echo "Error: Empty password is not allowed." >&2
|
||||||
|
return 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
if [[ "${pw1}" != "${pw2}" ]]; then
|
||||||
|
echo "Error: Password confirmation does not match." >&2
|
||||||
|
return 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
VAULT_PASS_FILE="$(mktemp)"
|
||||||
|
chmod 600 "${VAULT_PASS_FILE}"
|
||||||
|
printf '%s' "${pw1}" > "${VAULT_PASS_FILE}"
|
||||||
|
|
||||||
|
unset pw1 pw2
|
||||||
|
}
|
||||||
|
|
||||||
|
encrypt_with_prompted_password() {
|
||||||
|
ask_vault_password_once
|
||||||
|
ansible-vault encrypt \
|
||||||
|
--encrypt-vault-id "${VAULT_ID_LABEL}" \
|
||||||
|
--vault-password-file "${VAULT_PASS_FILE}" \
|
||||||
|
"$@"
|
||||||
|
}
|
||||||
|
|
||||||
|
encrypt_string_with_prompted_password() {
|
||||||
|
ask_vault_password_once
|
||||||
|
ansible-vault encrypt_string \
|
||||||
|
--encrypt-vault-id "${VAULT_ID_LABEL}" \
|
||||||
|
--vault-password-file "${VAULT_PASS_FILE}" \
|
||||||
|
"$@"
|
||||||
|
}
|
||||||
|
|
||||||
|
########################################
|
||||||
|
# Hilfe anzeigen
|
||||||
|
########################################
|
||||||
|
show_help() {
|
||||||
|
cat <<EOF
|
||||||
|
Usage:
|
||||||
|
$(basename "$0") [OPTION] [INPUT]
|
||||||
|
|
||||||
|
Modes:
|
||||||
|
|
||||||
|
1) File encrypt (in-place):
|
||||||
|
$(basename "$0") secrets.txt
|
||||||
|
|
||||||
|
2) YAML file (key: value -> !vault block):
|
||||||
|
$(basename "$0") vars.yml
|
||||||
|
$(basename "$0") -o output.yml vars.yml
|
||||||
|
|
||||||
|
3) String encrypt:
|
||||||
|
$(basename "$0") 'mySecret'
|
||||||
|
echo 'mySecret' | $(basename "$0")
|
||||||
|
$(basename "$0") (interactive mode)
|
||||||
|
|
||||||
|
Options:
|
||||||
|
-o FILE Write YAML output to FILE instead of stdout
|
||||||
|
-h, --help Show this help and exit
|
||||||
|
|
||||||
|
Notes:
|
||||||
|
- Simple "key: value" YAML lines will be converted.
|
||||||
|
- Already encrypted (!vault) entries are preserved.
|
||||||
|
- Full vault-encrypted files (ANSIBLE_VAULT header) are detected.
|
||||||
|
- Vault password is prompted once per script run.
|
||||||
|
- Vault ID defaults to "default" and can be changed via VAULT_ID_LABEL.
|
||||||
|
|
||||||
|
EOF
|
||||||
|
}
|
||||||
|
|
||||||
|
########################################
|
||||||
|
# Hauptfunktion
|
||||||
|
########################################
|
||||||
|
vencr() {
|
||||||
|
|
||||||
|
unset IFS
|
||||||
|
|
||||||
|
if [[ "${1:-}" == "-h" || "${1:-}" == "--help" ]]; then
|
||||||
|
show_help
|
||||||
|
return 0
|
||||||
|
fi
|
||||||
|
|
||||||
|
if ! command -v ansible-vault >/dev/null 2>&1; then
|
||||||
|
echo "Error: ansible-vault not found in PATH." >&2
|
||||||
|
return 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
########################################
|
||||||
|
# Optionales Output-File (-o)
|
||||||
|
########################################
|
||||||
|
local out_file=""
|
||||||
|
if [[ "${1:-}" == "-o" && -n "${2:-}" ]]; then
|
||||||
|
out_file="$2"
|
||||||
|
shift 2
|
||||||
|
fi
|
||||||
|
|
||||||
|
########################################
|
||||||
|
# 1) File als Argument
|
||||||
|
########################################
|
||||||
|
if [[ -n "${1:-}" && -f "$1" ]]; then
|
||||||
|
local f="$1"
|
||||||
|
|
||||||
|
if [[ "$(head -n1 "$f")" == "\$ANSIBLE_VAULT;1.1;AES256"* ]]; then
|
||||||
|
echo "File already encrypted (ANSIBLE_VAULT header found): $f" >&2
|
||||||
|
return 0
|
||||||
|
fi
|
||||||
|
|
||||||
|
if grep -Eq '^[[:space:]]*[A-Za-z0-9_.-]+:[[:space:]]*[^#].*$' "$f"; then
|
||||||
|
local tmpout
|
||||||
|
tmpout="$(mktemp)"
|
||||||
|
|
||||||
|
while IFS= read -r line || [[ -n "$line" ]]; do
|
||||||
|
|
||||||
|
if [[ -z "$line" || "$line" =~ ^[[:space:]]*# ]]; then
|
||||||
|
printf '%s\n' "$line" >> "$tmpout"
|
||||||
|
continue
|
||||||
|
fi
|
||||||
|
|
||||||
|
if echo "$line" | grep -q '\!vault'; then
|
||||||
|
printf '%s\n' "$line" >> "$tmpout"
|
||||||
|
continue
|
||||||
|
fi
|
||||||
|
|
||||||
|
if [[ "$line" =~ ^([[:space:]]*)([A-Za-z0-9_.-]+):[[:space:]]*(.+)$ ]]; then
|
||||||
|
local indent="${BASH_REMATCH[1]}"
|
||||||
|
local key="${BASH_REMATCH[2]}"
|
||||||
|
local value="${BASH_REMATCH[3]}"
|
||||||
|
|
||||||
|
if [[ "$value" == "|" || "$value" == ">" || "$value" == "" ]]; then
|
||||||
|
printf '%s\n' "$line" >> "$tmpout"
|
||||||
|
continue
|
||||||
|
fi
|
||||||
|
|
||||||
|
value="${value%\"}"; value="${value#\"}"
|
||||||
|
value="${value%\'}"; value="${value#\'}"
|
||||||
|
|
||||||
|
# Aus key: value wird ein key: !vault |-Block.
|
||||||
|
while IFS= read -r enc_line; do
|
||||||
|
printf '%s%s\n' "$indent" "$enc_line" >> "$tmpout"
|
||||||
|
done < <(
|
||||||
|
printf '%s' "$value" |
|
||||||
|
encrypt_string_with_prompted_password --stdin-name "$key"
|
||||||
|
)
|
||||||
|
|
||||||
|
else
|
||||||
|
printf '%s\n' "$line" >> "$tmpout"
|
||||||
|
fi
|
||||||
|
|
||||||
|
done < "$f"
|
||||||
|
|
||||||
|
if [[ -n "$out_file" ]]; then
|
||||||
|
mv "$tmpout" "$out_file"
|
||||||
|
echo "Encrypted YAML written to: $out_file" >&2
|
||||||
|
else
|
||||||
|
cat "$tmpout"
|
||||||
|
rm -f "$tmpout"
|
||||||
|
fi
|
||||||
|
|
||||||
|
return 0
|
||||||
|
fi
|
||||||
|
|
||||||
|
encrypt_with_prompted_password "$f"
|
||||||
|
echo "Encrypted file in-place: $f" >&2
|
||||||
|
return 0
|
||||||
|
fi
|
||||||
|
|
||||||
|
########################################
|
||||||
|
# 2) String-Verschluesselung
|
||||||
|
########################################
|
||||||
|
local str=""
|
||||||
|
local name="secret"
|
||||||
|
|
||||||
|
if [[ -n "${1:-}" ]]; then
|
||||||
|
str="$1"
|
||||||
|
elif [[ ! -t 0 ]]; then
|
||||||
|
str="$(cat)"
|
||||||
|
else
|
||||||
|
echo "Interactive mode."
|
||||||
|
read -r -p "Variable name (default: secret): " name_in
|
||||||
|
if [[ -n "$name_in" ]]; then
|
||||||
|
name="$name_in"
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo "Paste plaintext and press Ctrl-D to confirm:"
|
||||||
|
str="$(cat)"
|
||||||
|
echo
|
||||||
|
fi
|
||||||
|
|
||||||
|
printf '%s' "$str" | encrypt_string_with_prompted_password --stdin-name "$name"
|
||||||
|
}
|
||||||
|
|
||||||
|
trap cleanup EXIT
|
||||||
|
|
||||||
|
########################################
|
||||||
|
# Script starten
|
||||||
|
########################################
|
||||||
|
vencr "$@"
|
||||||
Executable
+221
@@ -0,0 +1,221 @@
|
|||||||
|
#!/usr/bin/env bash
|
||||||
|
#
|
||||||
|
# encrypt-vault-strings-to-file.sh
|
||||||
|
#
|
||||||
|
# Gegenstück zu deinem Decrypt-Script.
|
||||||
|
#
|
||||||
|
# Funktionen:
|
||||||
|
# 1. Komplettes File mit ansible-vault encrypt verschlüsseln
|
||||||
|
# 2. YAML-Datei mit key: value Zeilen in key: !vault | Blöcke umwandeln
|
||||||
|
# 3. Einzelnen String verschlüsseln (Argument, Pipe oder interaktiv)
|
||||||
|
#
|
||||||
|
# Vault-Passwortdatei: ~/.vault-pass
|
||||||
|
#
|
||||||
|
|
||||||
|
set -euo pipefail
|
||||||
|
|
||||||
|
########################################
|
||||||
|
# Hilfe anzeigen
|
||||||
|
########################################
|
||||||
|
show_help() {
|
||||||
|
cat <<EOF
|
||||||
|
Usage:
|
||||||
|
$(basename "$0") [OPTION] [INPUT]
|
||||||
|
|
||||||
|
Modes:
|
||||||
|
|
||||||
|
1) File encrypt (in-place):
|
||||||
|
$(basename "$0") secrets.txt
|
||||||
|
|
||||||
|
2) YAML file (key: value → !vault block):
|
||||||
|
$(basename "$0") vars.yml
|
||||||
|
$(basename "$0") -o output.yml vars.yml
|
||||||
|
|
||||||
|
Force whole-file encryption for a YAML file:
|
||||||
|
$(basename "$0") --full-file vars.yml
|
||||||
|
|
||||||
|
3) String encrypt:
|
||||||
|
$(basename "$0") 'mySecret'
|
||||||
|
echo 'mySecret' | $(basename "$0")
|
||||||
|
$(basename "$0") (interactive mode)
|
||||||
|
|
||||||
|
Options:
|
||||||
|
-o FILE Write YAML output to FILE instead of stdout
|
||||||
|
--full-file Encrypt the given file in-place, even if it is .yml/.yaml
|
||||||
|
-h, --help Show this help and exit
|
||||||
|
|
||||||
|
Notes:
|
||||||
|
- Simple "key: value" YAML lines will be converted.
|
||||||
|
- Already encrypted (!vault) entries are preserved.
|
||||||
|
- Full vault-encrypted files (ANSIBLE_VAULT header) are detected.
|
||||||
|
|
||||||
|
EOF
|
||||||
|
}
|
||||||
|
|
||||||
|
########################################
|
||||||
|
# Hauptfunktion
|
||||||
|
########################################
|
||||||
|
vencr() {
|
||||||
|
|
||||||
|
unset IFS
|
||||||
|
|
||||||
|
# --- Help Flag ---
|
||||||
|
if [[ "${1:-}" == "-h" || "${1:-}" == "--help" ]]; then
|
||||||
|
show_help
|
||||||
|
exit 0
|
||||||
|
fi
|
||||||
|
|
||||||
|
########################################
|
||||||
|
# Optionen: Ausgabe-Datei und Vollverschluesselung fuer YAML-Dateien.
|
||||||
|
########################################
|
||||||
|
local out_file=""
|
||||||
|
local force_full_file=0
|
||||||
|
while [[ -n "${1:-}" && "${1:-}" == -* ]]; do
|
||||||
|
case "$1" in
|
||||||
|
-o)
|
||||||
|
if [[ -z "${2:-}" ]]; then
|
||||||
|
echo "Error: -o requires a file name." >&2
|
||||||
|
return 1
|
||||||
|
fi
|
||||||
|
out_file="$2"
|
||||||
|
shift 2
|
||||||
|
;;
|
||||||
|
--full-file)
|
||||||
|
force_full_file=1
|
||||||
|
shift
|
||||||
|
;;
|
||||||
|
-h|--help)
|
||||||
|
show_help
|
||||||
|
exit 0
|
||||||
|
;;
|
||||||
|
--)
|
||||||
|
shift
|
||||||
|
break
|
||||||
|
;;
|
||||||
|
*)
|
||||||
|
break
|
||||||
|
;;
|
||||||
|
esac
|
||||||
|
done
|
||||||
|
|
||||||
|
########################################
|
||||||
|
# --- 1) File als Argument ---
|
||||||
|
########################################
|
||||||
|
if [[ -n "${1:-}" && -f "$1" ]]; then
|
||||||
|
local f="$1"
|
||||||
|
|
||||||
|
# Fall A: Datei ist bereits vollständig vault-verschlüsselt
|
||||||
|
if [[ "$(head -n1 "$f")" == "\$ANSIBLE_VAULT;1.1;AES256"* ]]; then
|
||||||
|
echo "File already encrypted (ANSIBLE_VAULT header found): $f" >&2
|
||||||
|
return 0
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Fall B: YAML mit key: value Zeilen nur fuer typische YAML-Dateien
|
||||||
|
# (damit z.B. README.md als normale Datei komplett verschluesselt wird).
|
||||||
|
if [[ $force_full_file -eq 0 ]] && [[ "$f" =~ \.(yml|yaml)$ ]] && grep -Eq '^[[:space:]]*[A-Za-z0-9_.-]+:[[:space:]]*[^#].*$' "$f"; then
|
||||||
|
local tmpout
|
||||||
|
tmpout="$(mktemp)"
|
||||||
|
|
||||||
|
# Datei zeilenweise lesen
|
||||||
|
while IFS= read -r line || [[ -n "$line" ]]; do
|
||||||
|
|
||||||
|
# Leere Zeilen oder Kommentare unverändert übernehmen
|
||||||
|
if [[ -z "$line" || "$line" =~ ^[[:space:]]*# ]]; then
|
||||||
|
printf '%s\n' "$line" >> "$tmpout"
|
||||||
|
continue
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Bereits verschlüsselte !vault Einträge nicht verändern
|
||||||
|
if echo "$line" | grep -q '\!vault'; then
|
||||||
|
printf '%s\n' "$line" >> "$tmpout"
|
||||||
|
continue
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Einfache key: value Zeilen erkennen
|
||||||
|
if [[ "$line" =~ ^([[:space:]]*)([A-Za-z0-9_.-]+):[[:space:]]*(.+)$ ]]; then
|
||||||
|
local indent="${BASH_REMATCH[1]}"
|
||||||
|
local key="${BASH_REMATCH[2]}"
|
||||||
|
local value="${BASH_REMATCH[3]}"
|
||||||
|
|
||||||
|
# YAML-Blockindikatoren nicht verändern
|
||||||
|
if [[ "$value" == "|" || "$value" == ">" || "$value" == "" ]]; then
|
||||||
|
printf '%s\n' "$line" >> "$tmpout"
|
||||||
|
continue
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Leichte Bereinigung von Quotes
|
||||||
|
value="${value%\"}"; value="${value#\"}"
|
||||||
|
value="${value%\'}"; value="${value#\'}"
|
||||||
|
|
||||||
|
# Verschlüsselung via ansible-vault encrypt_string
|
||||||
|
while IFS= read -r enc_line; do
|
||||||
|
printf '%s%s\n' "$indent" "$enc_line" >> "$tmpout"
|
||||||
|
done < <(
|
||||||
|
printf '%s' "$value" |
|
||||||
|
ansible-vault encrypt_string \
|
||||||
|
--stdin-name "$key"
|
||||||
|
)
|
||||||
|
|
||||||
|
else
|
||||||
|
# Nicht passende Zeilen unverändert übernehmen
|
||||||
|
printf '%s\n' "$line" >> "$tmpout"
|
||||||
|
fi
|
||||||
|
|
||||||
|
done < "$f"
|
||||||
|
|
||||||
|
# Output schreiben
|
||||||
|
if [[ -n "$out_file" ]]; then
|
||||||
|
mv "$tmpout" "$out_file"
|
||||||
|
echo "Encrypted YAML written to: $out_file" >&2
|
||||||
|
else
|
||||||
|
cat "$tmpout"
|
||||||
|
rm -f "$tmpout"
|
||||||
|
fi
|
||||||
|
|
||||||
|
return 0
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Fall C: Normale Datei → komplett verschlüsseln (in-place)
|
||||||
|
ansible-vault encrypt "$f"
|
||||||
|
|
||||||
|
echo "Encrypted file in-place: $f" >&2
|
||||||
|
return 0
|
||||||
|
fi
|
||||||
|
|
||||||
|
########################################
|
||||||
|
# --- 2) String-Verschlüsselung ---
|
||||||
|
########################################
|
||||||
|
local str=""
|
||||||
|
local name="secret"
|
||||||
|
|
||||||
|
# String als Argument
|
||||||
|
if [[ -n "${1:-}" ]]; then
|
||||||
|
str="$1"
|
||||||
|
|
||||||
|
# String via Pipe
|
||||||
|
elif [[ ! -t 0 ]]; then
|
||||||
|
str="$(cat)"
|
||||||
|
|
||||||
|
# Interaktiver Modus
|
||||||
|
else
|
||||||
|
echo "Interactive mode."
|
||||||
|
read -r -p "Variable name (default: secret): " name_in
|
||||||
|
if [[ -n "$name_in" ]]; then
|
||||||
|
name="$name_in"
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo "Paste plaintext and press Ctrl-D to confirm:"
|
||||||
|
str="$(cat)"
|
||||||
|
echo
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Ausgabe als YAML-kompatibler !vault Block
|
||||||
|
echo "Hallo"
|
||||||
|
printf '%s' "$str" | ansible-vault encrypt_string --stdin-name "$name"
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
########################################
|
||||||
|
# Script starten
|
||||||
|
########################################
|
||||||
|
vencr "$@"
|
||||||
Reference in New Issue
Block a user