vault

#!/bin/bash -e

# if no arguments then return the vault secret
# else encrypt a new secret

if [[ $# -eq 0 ]]; then
  if [[ ! -f vault.asc ]]; then
    echo >&2 "error: unable to find vault.asc!"
    exit 1
  fi

  gpg --batch --quiet --decrypt vault.asc
  exit 0
fi

if [[ $1 == -w ]]; then
  VAULT_ID=w@./wvault
  shift
else
  VAULT_ID=p@./vault
fi

if [[ $1 == -v || $1 == --view ]]; then
  if [[ $# -eq 2 && -f $2 ]]; then
    ansible-vault view --vault-id ${VAULT_ID} "$2"
  elif [[ $# -eq 3 && -f $2 ]]; then
    if ! command -v yq > /dev/null 2>&1; then
      echo >&2 "missing 'yq' (https://github.com/mikefarah/yq)"
      exit 1
    fi

    yq e ".${3}" "$2" |
      ansible-vault decrypt --vault-id ${VAULT_ID} - 2> /dev/null
  else
    echo >&2 "usage: $(basename "$0") [-w] -v ./to/file OR ./roles/file.yml var"
  fi
else
  if [[ $# -eq 1 && -f $1 ]]; then
    ansible-vault encrypt --vault-id ${VAULT_ID} "$1"
  elif [[ $# -eq 2 ]]; then
    ansible-vault encrypt_string --vault-id ${VAULT_ID} --name "$1" "$2"
  else
    echo >&2 "usage: $(basename "$0") [-w] [-v|--view] ./to/file OR key value"
  fi
fi

exit 0