iac/ansible/scripts/setup-vault.sh

#!/usr/bin/env bash
set -euo pipefail

# Ansible Vault Setup Script
# This script helps you set up encrypted secrets for the Ansible infrastructure

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
ANSIBLE_DIR="$(dirname "$SCRIPT_DIR")"
VAULT_FILE="$ANSIBLE_DIR/inventory/group_vars/all/vault.yaml"
VAULT_PASS_FILE="$ANSIBLE_DIR/.vault_pass"

echo "========================================"
echo "Ansible Vault Setup"
echo "========================================"
echo ""

# Check if ansible-vault is available
if ! command -v ansible-vault &> /dev/null; then
    echo "❌ Error: ansible-vault command not found"
    echo "   Please install Ansible first: pip install ansible"
    exit 1
fi

# Function to generate secrets
generate_secrets() {
    echo "Generating new Forgejo secrets..."
    echo ""
    echo "SECRET_KEY (64 chars hex):"
    openssl rand -hex 32
    echo ""
    echo "JWT_SECRET (base64):"
    openssl rand -base64 32
    echo ""
    echo "LFS_JWT_SECRET (base64):"
    openssl rand -base64 32
    echo ""
    echo "Copy these values to your vault.yaml file"
    echo ""
}

# Function to create vault password file
create_vault_password() {
    if [ -f "$VAULT_PASS_FILE" ]; then
        echo "⚠️  Vault password file already exists: $VAULT_PASS_FILE"
        read -p "Overwrite? (y/N): " -n 1 -r
        echo
        if [[ ! $REPLY =~ ^[Yy]$ ]]; then
            echo "Skipping vault password creation"
            return
        fi
    fi

    echo "Creating vault password file..."
    read -sp "Enter vault password: " password
    echo ""
    read -sp "Confirm password: " password2
    echo ""

    if [ "$password" != "$password2" ]; then
        echo "❌ Passwords don't match"
        exit 1
    fi

    echo "$password" > "$VAULT_PASS_FILE"
    chmod 600 "$VAULT_PASS_FILE"
    echo "✅ Vault password saved to: $VAULT_PASS_FILE"
    echo "   (This file is git-ignored)"
    echo ""
}

# Function to encrypt vault
encrypt_vault() {
    if [ ! -f "$VAULT_FILE" ]; then
        echo "❌ Vault file not found: $VAULT_FILE"
        echo "   Please create it first from the template"
        exit 1
    fi

    # Check if already encrypted
    if head -n1 "$VAULT_FILE" | grep -q "ANSIBLE_VAULT"; then
        echo "⚠️  Vault file is already encrypted"
        return
    fi

    if [ ! -f "$VAULT_PASS_FILE" ]; then
        echo "❌ Vault password file not found: $VAULT_PASS_FILE"
        echo "   Run: $0 create-password"
        exit 1
    fi

    echo "Encrypting vault file..."
    ansible-vault encrypt "$VAULT_FILE" --vault-password-file="$VAULT_PASS_FILE" --encrypt-vault-id default
    echo "✅ Vault encrypted successfully"
    echo ""
}

# Function to decrypt vault
decrypt_vault() {
    if [ ! -f "$VAULT_FILE" ]; then
        echo "❌ Vault file not found: $VAULT_FILE"
        exit 1
    fi

    # Check if encrypted
    if ! head -n1 "$VAULT_FILE" | grep -q "ANSIBLE_VAULT"; then
        echo "⚠️  Vault file is not encrypted"
        return
    fi

    if [ ! -f "$VAULT_PASS_FILE" ]; then
        echo "❌ Vault password file not found: $VAULT_PASS_FILE"
        exit 1
    fi

    echo "Decrypting vault file..."
    ansible-vault decrypt "$VAULT_FILE" --vault-password-file="$VAULT_PASS_FILE"
    echo "✅ Vault decrypted successfully"
    echo "⚠️  Remember to re-encrypt before committing!"
    echo ""
}

# Function to edit vault
edit_vault() {
    if [ ! -f "$VAULT_FILE" ]; then
        echo "❌ Vault file not found: $VAULT_FILE"
        exit 1
    fi

    if [ ! -f "$VAULT_PASS_FILE" ]; then
        echo "❌ Vault password file not found: $VAULT_PASS_FILE"
        echo "   Run: $0 create-password"
        exit 1
    fi

    echo "Opening vault for editing..."
    ansible-vault edit "$VAULT_FILE" --vault-password-file="$VAULT_PASS_FILE"
}

# Function to view vault
view_vault() {
    if [ ! -f "$VAULT_FILE" ]; then
        echo "❌ Vault file not found: $VAULT_FILE"
        exit 1
    fi

    if [ ! -f "$VAULT_PASS_FILE" ]; then
        echo "❌ Vault password file not found: $VAULT_PASS_FILE"
        exit 1
    fi

    ansible-vault view "$VAULT_FILE" --vault-password-file="$VAULT_PASS_FILE"
}

# Function to check vault status
check_status() {
    echo "Vault Status:"
    echo "-------------"

    if [ -f "$VAULT_PASS_FILE" ]; then
        echo "✅ Vault password file exists: $VAULT_PASS_FILE"
    else
        echo "❌ Vault password file not found: $VAULT_PASS_FILE"
    fi

    if [ -f "$VAULT_FILE" ]; then
        if head -n1 "$VAULT_FILE" | grep -q "ANSIBLE_VAULT"; then
            echo "✅ Vault file is encrypted: $VAULT_FILE"
        else
            echo "⚠️  Vault file exists but is NOT encrypted: $VAULT_FILE"
            echo "   Run: $0 encrypt"
        fi
    else
        echo "❌ Vault file not found: $VAULT_FILE"
    fi
    echo ""
}

# Main menu
case "${1:-}" in
    generate-secrets)
        generate_secrets
        ;;
    create-password)
        create_vault_password
        ;;
    encrypt)
        encrypt_vault
        ;;
    decrypt)
        decrypt_vault
        ;;
    edit)
        edit_vault
        ;;
    view)
        view_vault
        ;;
    status)
        check_status
        ;;
    *)
        echo "Usage: $0 {generate-secrets|create-password|encrypt|decrypt|edit|view|status}"
        echo ""
        echo "Commands:"
        echo "  generate-secrets  - Generate new Forgejo secrets"
        echo "  create-password   - Create vault password file (.vault_pass)"
        echo "  encrypt          - Encrypt vault.yaml"
        echo "  decrypt          - Decrypt vault.yaml (use carefully!)"
        echo "  edit             - Edit encrypted vault"
        echo "  view             - View encrypted vault contents"
        echo "  status           - Check vault status"
        echo ""
        echo "Quick setup:"
        echo "  1. $0 generate-secrets    # Generate new secrets"
        echo "  2. Edit vault.yaml with your secrets"
        echo "  3. $0 create-password     # Create password file"
        echo "  4. $0 encrypt            # Encrypt vault"
        echo ""
        exit 1
        ;;
esac