diff --git a/scripts/scripts/vault-gopass b/scripts/scripts/vault-gopass new file mode 100755 index 0000000..9c2e245 --- /dev/null +++ b/scripts/scripts/vault-gopass @@ -0,0 +1,78 @@ +#!/usr/bin/env zsh +# +# An adapter script to use gopass to store and retrieve passwords for ansible vault. +# +# When calling from ansible vault it get's passed --vault-id [ID] which is the id +# of the secret to retrieve. +# + +local secretPath="ansible" + +function usage() { + cat <'. + + Usage: vault-gopass [-s | --set] [-g | --generate] [--vault-id ] [ID] + + -s | --set: Set a new secret for the given ID. + -g | --generate: Used with the set option to automatically generate the secret. + --vault-id : Used to retrieve a secret for the given ID. + -h | --help: Show this usage message. + + Examples: + + # Automatically generate a secret for the 'foo' id. + $ vault-gopass --set --generate foo + + # Retrieve the secret for 'foo' and print it to stdout. + $ vault-gopass --vault-id foo + +EOF +} + +# parse the passed in options, failing if unrecognized options are given. +zparseopts -D -E -F - \ + g=generateFlag -generate=generateFlag \ + h=helpFlag -help=helpFlag \ + s=setFlag -set=setFlag \ + -vault-id:=vaultId \ + || exit 1 + +# check for the help flag, show usage and exit. +[ ${#helpFlag} = 1 ] && usage && exit 0 + +if [ ${#vaultId} = 2 ]; then + # we received the vault-id option, so we print the + # secret to stdout + gopass show --password "$secretPath/${vaultId[-1]}" + +elif [ ${#setFlag} = 1 ]; then + + # Use the first argument as the id, we ask for an id + # if not supplied. + local id=$1 + if [ "$id" = "" ]; then + read -r id\?"Vault ID: " + fi + + # Check for generate flag to automatically generate a password. + [ ${#generateFlag} = 1 ] \ + && gopass generate "$secretPath/$id" 24 \ + && exit 0 + + # Insert a password prompting the user to supply it. + gopass insert "$secretPath/$id" +fi diff --git a/scripts/scripts/vault-gopass.zsh b/scripts/scripts/vault-gopass.zsh deleted file mode 100755 index f561988..0000000 --- a/scripts/scripts/vault-gopass.zsh +++ /dev/null @@ -1,30 +0,0 @@ -#!/usr/bin/env zsh - -zparseopts -D -E -F - \ - g=generateFlag -generate=generateFlag \ - s=setFlag -set=setFlag \ - -vault-id:=vaultId \ - || exit 1 - -function generate_pass() { - gopass generate "ansible/$1" 24 -} - -if [ ${#vaultId} = 2 ]; then - gopass show -o "${vaultId[-1]}" -elif [ ${#setFlag} = 1 ]; then - # Use the first argument as the id, ask for an id - # if not supplied. - local id=$1 - if [ "$id" = "" ]; then - read -r id\?"Ansible ID: " - fi - - # Check for generate flag to automatically generate a password. - [ ${#generateFlag} = 1 ] \ - && gopass generate "ansible/$id" 24 \ - && exit 0 - - # Insert a password prompting the user to supply it. - gopass insert "ansible/$id" -fi