La password di decrittazione del vault viene richiesta tutte le volte.

This commit is contained in:
Emiliano Vavassori 2015-07-14 21:42:16 +02:00
parent b061747b78
commit 7f7e93c935
3 changed files with 4 additions and 7 deletions

View File

@ -10,4 +10,4 @@ logfile=/var/lib/ansible-pull.log
branch=master
playbook=local.yml
ansible-pull --accept-host-key -d "${repo}" -U "${url}" -C "${branch}" "${playbook}" --vault-password-file "/root/.ansible/vault.txt"
ansible-pull --accept-host-key -d "${repo}" -U "${url}" -C "${branch}" "${playbook}" --vault-password "$(/var/lib/{{ domainfull }}/bin/getvaultpass.py)"

View File

@ -14,8 +14,4 @@ base64enc = get("http://{{ serverfqdn }}:3000/vaultpass")
encrypted = b64decode(base64enc.content)
longpass = cipher.decrypt(encrypted)
if not path.exists('/root/.ansible'):
makedirs('/root/.ansible')
with open('/root/.ansible/vault.txt', 'w+') as vaultfile:
vaultfile.write(longpass.strip('x'))
print(longpass.strip('x'))

View File

@ -17,7 +17,8 @@ install -d -o root -g root /var/lib/{{ domainfull }}/bin
# Installo lo script per la decrittazione della password del vault
wget -q http://{{ serverfqdn }}/ks/getvaultpass.py -O /tmp/getvaultpass.py
python /tmp/getvaultpass.py && rm -f /tmp/getvaultpass.py
install -m744 -o root -g root /tmp/getvaultpass.py /var/lib/{{ domainfull}}/bin/getvaultpass.py
rm -f /tmp/getvaultpass.py
# Installo lo script per l'avvio di ansible-pull da root
wget -q http://{{ serverfqdn }}/ks/ansible-pull.sh -O /tmp/ansible-pull.sh