https://github.com/wkoszek/lastpass-ansible
Unlock Ansible Vault with LastPass
https://github.com/wkoszek/lastpass-ansible
ansible automation ssh
Last synced: 9 months ago
JSON representation
Unlock Ansible Vault with LastPass
- Host: GitHub
- URL: https://github.com/wkoszek/lastpass-ansible
- Owner: wkoszek
- License: bsd-2-clause
- Created: 2017-03-05T18:59:20.000Z (over 9 years ago)
- Default Branch: master
- Last Pushed: 2017-03-18T15:24:53.000Z (over 9 years ago)
- Last Synced: 2025-09-11T10:33:58.640Z (10 months ago)
- Topics: ansible, automation, ssh
- Language: Ruby
- Size: 88.9 KB
- Stars: 22
- Watchers: 2
- Forks: 1
- Open Issues: 1
-
Metadata Files:
- Readme: README.md
- License: LICENSE.md
Awesome Lists containing this project
README
# Unlock Ansible Vault with LastPass
[](https://travis-ci.org/wkoszek/lastpass-ansible)
Script `lastpass-ansible` in this project will let you unlock [Ansible
Vault][] with the password stored in [LastPass][]. This means you'll be able
to run `ansible-playbook` and `ansible-vault` commands without being
prompted for the password: it'll be taken from LastPass automatically.
You can keep your Ansible Vault passwords along with your other
secrets in LastPass, and not worry about forgetting your passwords.
You should also use LastPass's strong password generator for your Ansible
Vault password.
The 'lastpass-ansible' is designed so that it integrates easily with your
existing flow.
# How to install
You install the tool in the terminal:
gem install lastpass-ansible
# How to use
You must point Ansible to use `lastpass-ansible`:
export ANSIBLE_VAULT_PASSWORD_FILE=`command -v lastpass-ansible`
Now assume you're in your web application directory:
cd ~/Projects/my_web_app
Now do:
lastpass-ansible --init
This will create a new "site" in LastPass in the hierarchy `Ansible_Vault/my_web_app`.
It'll also generate a 30-character password for this site.
**If you want to stick to your current Vault password**
Just go to LastPass, edit the site in `Ansible_Vault/my_web_app` and put your password there. Save.
**If you want to use the new password:**
lpass show -c -p Ansible_Vault/my_web_app
ansible-vault rekey secrets.yml
First command copies the newly generated password to the clipboard, and the second one will replace the old password with the new one. It's so called re-keying the Vault. Clear the clipboard afterwards.
# More details and custom settings
File `.lastpass-ansible.conf` has been created along with the password. It just
tells `lastpass-ansible` which LastPass site to use to get the proper password.
If you're fine with `Ansible_Vault/...`, then you can remove this file. It's a
default lookup location.
If you're a picky person and you don't like `Ansible_Vault` OR you want to
point `lastpass-ansible` to an existing hierarchy of sites in LastPass, just stick it
to `.lastpass-ansible.conf`. It's format is very easy:
# lastpass-ansible configuration file. For more details read:
# https://github.com/wkoszek/lastpass-ansible
MyWebSites/my_web_app
And it'll work. The order of lookup for this LastPass site name is:
1. `.lastpass-ansible.conf` file
2. `LASTPASS_ANSIBLE_NAME` environment variable
3. Name guessed based on a directory: "Ansible_Vault" + name
It should be safe to commit `.lastpass-ansible.conf` to your repository.
If you're paranoid, just use `LASTPASS_ANSIBLE_NAME` environment variable
for passing this name. Otherwise just use the guessed name. I think it's the
most convenient.
[Ansible Vault]: http://docs.ansible.com/ansible/playbooks_vault.html
[LastPass]: https://www.lastpass.com
## More
- [How to use Ansible Vault with LastPass](https://www.koszek.com/blog/2017/03/05/how-to-use-ansible-vault-with-lastpass/)
## Author
- Wojciech Adam Koszek, [wojciech@koszek.com](mailto:wojciech@koszek.com)
- [http://www.koszek.com](http://www.koszek.com)
- Twitter: [@wkoszek](https://twitter.com/wkoszek)
- LinkedIn: [wkoszek](https://www.linkedin.com/in/wkoszek)