{"id":16777479,"url":"https://github.com/bbaassssiiee/ansible_pass_gpg","last_synced_at":"2026-04-17T09:32:25.381Z","repository":{"id":90538194,"uuid":"521431020","full_name":"bbaassssiiee/ansible_pass_gpg","owner":"bbaassssiiee","description":"Use gpg script as ANSIBLE_VAULT_PASSWORD_FILE","archived":false,"fork":false,"pushed_at":"2023-10-05T12:58:40.000Z","size":7,"stargazers_count":0,"open_issues_count":0,"forks_count":1,"subscribers_count":1,"default_branch":"main","last_synced_at":"2026-01-28T11:47:44.089Z","etag":null,"topics":["ansible","encryption","gpg-encryption"],"latest_commit_sha":null,"homepage":"","language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/bbaassssiiee.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2022-08-04T22:21:12.000Z","updated_at":"2022-08-04T22:27:15.000Z","dependencies_parsed_at":null,"dependency_job_id":"440df976-faed-4383-a01d-56262cf162ca","html_url":"https://github.com/bbaassssiiee/ansible_pass_gpg","commit_stats":null,"previous_names":[],"tags_count":1,"template":false,"template_full_name":null,"purl":"pkg:github/bbaassssiiee/ansible_pass_gpg","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/bbaassssiiee%2Fansible_pass_gpg","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/bbaassssiiee%2Fansible_pass_gpg/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/bbaassssiiee%2Fansible_pass_gpg/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/bbaassssiiee%2Fansible_pass_gpg/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/bbaassssiiee","download_url":"https://codeload.github.com/bbaassssiiee/ansible_pass_gpg/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/bbaassssiiee%2Fansible_pass_gpg/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":31923141,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-04-17T09:10:15.403Z","status":"ssl_error","status_checked_at":"2026-04-17T09:10:14.455Z","response_time":62,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["ansible","encryption","gpg-encryption"],"created_at":"2024-10-13T07:24:51.509Z","updated_at":"2026-04-17T09:32:25.363Z","avatar_url":"https://github.com/bbaassssiiee.png","language":"Shell","funding_links":[],"categories":[],"sub_categories":[],"readme":"# ansible\\_pass\\_gpg\nInstall GPG as a helper for ansible-vault\n\nGPG is useful if you want to sign commits in git, or if you want to use encryption, decryption, signing and verification.\n\n## Ansible-vault\n\nThe ansible-vault command-line tool allows us to create and edit an encrypted file that ansible-playbook will recognize and decrypt automatically, given the password.\n\nThis tool ensures the data is encrypted at rest (i.e, on disk) only. It is your own responsibility to set `no_log: true` on tasks that use this data.\n\nWe can encrypt an existing file like this:\n\n```\n $ ansible-vault encrypt secrets.yml\n```\n\nAlternately, we can create a new encrypted file in the special directory `group_vars/all/` next to our playbook. I store global variables in `group_vars/all/vars.yml` and secrets in `group_vars/all/vault` (without extension, to not confuse linters and editors).\n\n```\n$ mkdir -p group_vars/all/\n$ ansible-vault create group_vars/all/vault\n```\n\nansible-vault prompts for a password, and will then launch a text editor so that you can work in the file. It launches the editor specified in the **$EDITOR** environment variable. If that variable is not defined in your shell’s profile (export EDITOR=code), it defaults to vim.\n\nUse the `vars_files` section of a play to reference a file encrypted with ansible-vault the same way you would access a regular file.\n\nansible-playbook needs to prompt us for the password of the encrypted file, or it will simply error out. Do so by using the `--ask-vault-pass` argument:\n\n```\n $ ansible-playbook --ask-vault-pass playbook.yml\n```\n\nYou can also store the password in a text file and tell ansible-playbook its location by using the **ANSIBLE_VAULT_PASSWORD_FILE** environment variable or the `--vault-password-file` argument:\n\n```\n $ ansible-playbook playbook.yml --vault-password-file ~/password.txt\n```\n\nIf the argument to `--vault-password-file` has the **executable** bit set, Ansible will execute it and use the contents of standard out as the vault password. This allows you to use a script to supply the password to Ansible.\n\n\n# Encrypted secrets with password in home directory\n\nIn automation providing a password on a prompt is not always feasible or desirable. Then we can use one, or several files in the home directory: `.vault_pass_cloud`, or `.vault_pass_acc`, and a `.vault_pass_prod password`.\n\nThese files don't need to be plain-text, but when they are ensure restrictive permissions. Much better to encrypt them with GPG and delete tha plain-text files:\n\n```bash\ngpg -e -r john.doe@example.com ~/.vault_pass_cloud\nrm ~/.vault_pass_cloud\n```\n\nThe environment variable ANSIBLE_VAULT_PASSWORD_FILE points to a file to find the password. If that file is an executable, then it is run to retrieve the password from stdout.\n\nYou can simply start with one file:\n`export ANSIBLE_VAULT_PASSWORD_FILE=~/.vault_pass_cloud`\n\nTo edit the `secrets` file you can run this command:\n\n`ansible-vault edit --encrypt-vault-id cloud --vault-id cloud@~/.vault_pass_cloud linux_test/secrets`\n\n## This role\n\nThis role lets you decrypt the vault files (`.vault_pass_whatever.gpg`) using pretty good privacy in a transparent way, using gpg agent. You don't need to type the GPG passphrase all the time, and the vault passwords for the vaults are encrypted on disk with personal keys.\n\nFirst you need to encrypt the ansible-vault password into such a file:\n```\necho 'Your_vault_password' \u003e \"${HOME}/.vault_pw\"\ngpg -e -r $(gpg --list-secret-keys|grep ultimate|head -1|cut -d\\\u003c -f2|cut -d\\\u003e -f1) \"${HOME}/.vault_pw\"\nrm \"${HOME}/.vault_pw\"\n```\n\n# Encrypted secrets in multiple vaults\n\nThere are situations in which you want to use multiple Vault files with different passwords (e.g., when you have different Vaults per environment that have different passwords). That’s where Vault Identities come in.\n\nLet's say we need separate passwords, one for the \"cloud\" and one each for the \"acc\" and \"prod\" environment. We place these Vault files in their respective locations, $INFRA/group_vars/\u003cANSIBLE_INVENTORY/secrets.\n\nTo distinguish between the password files, we use Vault Identities to separate them and the vaults. To make this work, add the necessary vault-id flag to the ansible-vault commands. \n\n`ansible-vault edit --encrypt-vault-id cloud --ask-vault-pass linux_test/secrets` \n\n## Troubleshooting\n\nCheck if you can decrypt the file:\n```\ngpg -q -d \"${HOME}/.vault_pass_cloud.gpg\"\n```\n\nCheck if the environment variable is set correctly:\n```\ncat $ANSIBLE_VAULT_PASSWORD_FILE\n```\n\nThis should contain:\n`exec gpg -q -d \"${HOME}/.vault_pass_cloud.gpg\"`\n\nRun the $ANSIBLE_VAULT_PASSWORD_FILE executable:\n\n```\n$ANSIBLE_VAULT_PASSWORD_FILE\n```\nThis should print the password.\n\n## Development\nYou cannot run molecule localhost straightaway, first unset this environment variable and authenticate:\n\n```sh\nunset ANSIBLE_VAULT_PASSWORD_FILE\nsudo -v\nmolecule test -s localhost\nmolecule converge -s localhost\n```\n\n### Required packages\n\nFor python scripting:\n\n```\npip install --user -r requirements.txt\n```\n\n### Role variables\n\n- `default_cache_ttl:` Interval in seconds (Default: 7200).\n- `vault_user`: The user for whom the configuration should be applied (Default: $USER).\n\n\n### Role dependencies\n\nAnsible\n\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fbbaassssiiee%2Fansible_pass_gpg","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fbbaassssiiee%2Fansible_pass_gpg","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fbbaassssiiee%2Fansible_pass_gpg/lists"}