ansible rework

ansible/scripts/setup-vault.sh

@@ -0,0 +1,221 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Ansible Vault Setup Script
+# This script helps you set up encrypted secrets for the Ansible infrastructure
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+ANSIBLE_DIR="$(dirname "$SCRIPT_DIR")"
+VAULT_FILE="$ANSIBLE_DIR/inventory/group_vars/all/vault.yaml"
+VAULT_PASS_FILE="$ANSIBLE_DIR/.vault_pass"
+
+echo "========================================"
+echo "Ansible Vault Setup"
+echo "========================================"
+echo ""
+
+# Check if ansible-vault is available
+if ! command -v ansible-vault &> /dev/null; then
+    echo "❌ Error: ansible-vault command not found"
+    echo "   Please install Ansible first: pip install ansible"
+    exit 1
+fi
+
+# Function to generate secrets
+generate_secrets() {
+    echo "Generating new Forgejo secrets..."
+    echo ""
+    echo "SECRET_KEY (64 chars hex):"
+    openssl rand -hex 32
+    echo ""
+    echo "JWT_SECRET (base64):"
+    openssl rand -base64 32
+    echo ""
+    echo "LFS_JWT_SECRET (base64):"
+    openssl rand -base64 32
+    echo ""
+    echo "Copy these values to your vault.yaml file"
+    echo ""
+}
+
+# Function to create vault password file
+create_vault_password() {
+    if [ -f "$VAULT_PASS_FILE" ]; then
+        echo "⚠️  Vault password file already exists: $VAULT_PASS_FILE"
+        read -p "Overwrite? (y/N): " -n 1 -r
+        echo
+        if [[ ! $REPLY =~ ^[Yy]$ ]]; then
+            echo "Skipping vault password creation"
+            return
+        fi
+    fi
+
+    echo "Creating vault password file..."
+    read -sp "Enter vault password: " password
+    echo ""
+    read -sp "Confirm password: " password2
+    echo ""
+
+    if [ "$password" != "$password2" ]; then
+        echo "❌ Passwords don't match"
+        exit 1
+    fi
+
+    echo "$password" > "$VAULT_PASS_FILE"
+    chmod 600 "$VAULT_PASS_FILE"
+    echo "✅ Vault password saved to: $VAULT_PASS_FILE"
+    echo "   (This file is git-ignored)"
+    echo ""
+}
+
+# Function to encrypt vault
+encrypt_vault() {
+    if [ ! -f "$VAULT_FILE" ]; then
+        echo "❌ Vault file not found: $VAULT_FILE"
+        echo "   Please create it first from the template"
+        exit 1
+    fi
+
+    # Check if already encrypted
+    if head -n1 "$VAULT_FILE" | grep -q "ANSIBLE_VAULT"; then
+        echo "⚠️  Vault file is already encrypted"
+        return
+    fi
+
+    if [ ! -f "$VAULT_PASS_FILE" ]; then
+        echo "❌ Vault password file not found: $VAULT_PASS_FILE"
+        echo "   Run: $0 create-password"
+        exit 1
+    fi
+
+    echo "Encrypting vault file..."
+    ansible-vault encrypt "$VAULT_FILE" --vault-password-file="$VAULT_PASS_FILE" --encrypt-vault-id default
+    echo "✅ Vault encrypted successfully"
+    echo ""
+}
+
+# Function to decrypt vault
+decrypt_vault() {
+    if [ ! -f "$VAULT_FILE" ]; then
+        echo "❌ Vault file not found: $VAULT_FILE"
+        exit 1
+    fi
+
+    # Check if encrypted
+    if ! head -n1 "$VAULT_FILE" | grep -q "ANSIBLE_VAULT"; then
+        echo "⚠️  Vault file is not encrypted"
+        return
+    fi
+
+    if [ ! -f "$VAULT_PASS_FILE" ]; then
+        echo "❌ Vault password file not found: $VAULT_PASS_FILE"
+        exit 1
+    fi
+
+    echo "Decrypting vault file..."
+    ansible-vault decrypt "$VAULT_FILE" --vault-password-file="$VAULT_PASS_FILE"
+    echo "✅ Vault decrypted successfully"
+    echo "⚠️  Remember to re-encrypt before committing!"
+    echo ""
+}
+
+# Function to edit vault
+edit_vault() {
+    if [ ! -f "$VAULT_FILE" ]; then
+        echo "❌ Vault file not found: $VAULT_FILE"
+        exit 1
+    fi
+
+    if [ ! -f "$VAULT_PASS_FILE" ]; then
+        echo "❌ Vault password file not found: $VAULT_PASS_FILE"
+        echo "   Run: $0 create-password"
+        exit 1
+    fi
+
+    echo "Opening vault for editing..."
+    ansible-vault edit "$VAULT_FILE" --vault-password-file="$VAULT_PASS_FILE"
+}
+
+# Function to view vault
+view_vault() {
+    if [ ! -f "$VAULT_FILE" ]; then
+        echo "❌ Vault file not found: $VAULT_FILE"
+        exit 1
+    fi
+
+    if [ ! -f "$VAULT_PASS_FILE" ]; then
+        echo "❌ Vault password file not found: $VAULT_PASS_FILE"
+        exit 1
+    fi
+
+    ansible-vault view "$VAULT_FILE" --vault-password-file="$VAULT_PASS_FILE"
+}
+
+# Function to check vault status
+check_status() {
+    echo "Vault Status:"
+    echo "-------------"
+
+    if [ -f "$VAULT_PASS_FILE" ]; then
+        echo "✅ Vault password file exists: $VAULT_PASS_FILE"
+    else
+        echo "❌ Vault password file not found: $VAULT_PASS_FILE"
+    fi
+
+    if [ -f "$VAULT_FILE" ]; then
+        if head -n1 "$VAULT_FILE" | grep -q "ANSIBLE_VAULT"; then
+            echo "✅ Vault file is encrypted: $VAULT_FILE"
+        else
+            echo "⚠️  Vault file exists but is NOT encrypted: $VAULT_FILE"
+            echo "   Run: $0 encrypt"
+        fi
+    else
+        echo "❌ Vault file not found: $VAULT_FILE"
+    fi
+    echo ""
+}
+
+# Main menu
+case "${1:-}" in
+    generate-secrets)
+        generate_secrets
+        ;;
+    create-password)
+        create_vault_password
+        ;;
+    encrypt)
+        encrypt_vault
+        ;;
+    decrypt)
+        decrypt_vault
+        ;;
+    edit)
+        edit_vault
+        ;;
+    view)
+        view_vault
+        ;;
+    status)
+        check_status
+        ;;
+    *)
+        echo "Usage: $0 {generate-secrets|create-password|encrypt|decrypt|edit|view|status}"
+        echo ""
+        echo "Commands:"
+        echo "  generate-secrets  - Generate new Forgejo secrets"
+        echo "  create-password   - Create vault password file (.vault_pass)"
+        echo "  encrypt          - Encrypt vault.yaml"
+        echo "  decrypt          - Decrypt vault.yaml (use carefully!)"
+        echo "  edit             - Edit encrypted vault"
+        echo "  view             - View encrypted vault contents"
+        echo "  status           - Check vault status"
+        echo ""
+        echo "Quick setup:"
+        echo "  1. $0 generate-secrets    # Generate new secrets"
+        echo "  2. Edit vault.yaml with your secrets"
+        echo "  3. $0 create-password     # Create password file"
+        echo "  4. $0 encrypt            # Encrypt vault"
+        echo ""
+        exit 1
+        ;;
+esac