From 7f7e93c935f5b8406f9f25de72875305b44979c6 Mon Sep 17 00:00:00 2001 From: Emiliano Vavassori Date: Tue, 14 Jul 2015 21:42:16 +0200 Subject: [PATCH] La password di decrittazione del vault viene richiesta tutte le volte. --- roles/pxe/templates/ks/ansible-pull.sh | 2 +- roles/pxe/templates/ks/getvaultpass.py | 6 +----- roles/pxe/templates/ks/post-ks.sh | 3 ++- 3 files changed, 4 insertions(+), 7 deletions(-) diff --git a/roles/pxe/templates/ks/ansible-pull.sh b/roles/pxe/templates/ks/ansible-pull.sh index 332f211..98197dc 100644 --- a/roles/pxe/templates/ks/ansible-pull.sh +++ b/roles/pxe/templates/ks/ansible-pull.sh @@ -10,4 +10,4 @@ logfile=/var/lib/ansible-pull.log branch=master playbook=local.yml -ansible-pull --accept-host-key -d "${repo}" -U "${url}" -C "${branch}" "${playbook}" --vault-password-file "/root/.ansible/vault.txt" +ansible-pull --accept-host-key -d "${repo}" -U "${url}" -C "${branch}" "${playbook}" --vault-password "$(/var/lib/{{ domainfull }}/bin/getvaultpass.py)" diff --git a/roles/pxe/templates/ks/getvaultpass.py b/roles/pxe/templates/ks/getvaultpass.py index 699e0b7..f6ed23b 100644 --- a/roles/pxe/templates/ks/getvaultpass.py +++ b/roles/pxe/templates/ks/getvaultpass.py @@ -14,8 +14,4 @@ base64enc = get("http://{{ serverfqdn }}:3000/vaultpass") encrypted = b64decode(base64enc.content) longpass = cipher.decrypt(encrypted) -if not path.exists('/root/.ansible'): - makedirs('/root/.ansible') - -with open('/root/.ansible/vault.txt', 'w+') as vaultfile: - vaultfile.write(longpass.strip('x')) +print(longpass.strip('x')) diff --git a/roles/pxe/templates/ks/post-ks.sh b/roles/pxe/templates/ks/post-ks.sh index 7e2b59a..516188d 100644 --- a/roles/pxe/templates/ks/post-ks.sh +++ b/roles/pxe/templates/ks/post-ks.sh @@ -17,7 +17,8 @@ install -d -o root -g root /var/lib/{{ domainfull }}/bin # Installo lo script per la decrittazione della password del vault wget -q http://{{ serverfqdn }}/ks/getvaultpass.py -O /tmp/getvaultpass.py -python /tmp/getvaultpass.py && rm -f /tmp/getvaultpass.py +install -m744 -o root -g root /tmp/getvaultpass.py /var/lib/{{ domainfull}}/bin/getvaultpass.py +rm -f /tmp/getvaultpass.py # Installo lo script per l'avvio di ansible-pull da root wget -q http://{{ serverfqdn }}/ks/ansible-pull.sh -O /tmp/ansible-pull.sh