diff --git a/roles/pxe/templates/ks/ansible-pull.sh b/roles/pxe/templates/ks/ansible-pull.sh index 98197dc..ec0bac8 100644 --- a/roles/pxe/templates/ks/ansible-pull.sh +++ b/roles/pxe/templates/ks/ansible-pull.sh @@ -10,4 +10,7 @@ logfile=/var/lib/ansible-pull.log branch=master playbook=local.yml -ansible-pull --accept-host-key -d "${repo}" -U "${url}" -C "${branch}" "${playbook}" --vault-password "$(/var/lib/{{ domainfull }}/bin/getvaultpass.py)" +vaultpassfile=$(/var/lib/{{ domainfull }}/bin/getvaultpass.py) + +ansible-pull --accept-host-key -d "${repo}" -U "${url}" -C "${branch}" "${playbook}" --vault-password-file "${vaultpassfile}" +rm -f "${vaultpassfile}" diff --git a/roles/pxe/templates/ks/getvaultpass.py b/roles/pxe/templates/ks/getvaultpass.py index f6ed23b..0c3e5bd 100644 --- a/roles/pxe/templates/ks/getvaultpass.py +++ b/roles/pxe/templates/ks/getvaultpass.py @@ -6,7 +6,8 @@ from Crypto.Cipher import AES from base64 import b64decode from requests import get from socket import gethostname -from os import makedirs, path +from tempfile import mkstemp +import os key = MD5.new(gethostname()).digest() cipher = AES.new(key, AES.MODE_ECB) @@ -14,4 +15,9 @@ base64enc = get("http://{{ serverfqdn }}:3000/vaultpass") encrypted = b64decode(base64enc.content) longpass = cipher.decrypt(encrypted) -print(longpass.strip('x')) +fd, filename = mkstemp() +with open(filename, 'w+') as f: + f.write(longpass.strip('x')) +os.close(fd) + +print(filename)