From 20fb830edab58567a37a284bb50f4586e0f63f45 Mon Sep 17 00:00:00 2001
From: "Dustin C. Hatch" <dustin@hatch.name>
Date: Mon, 29 Jan 2018 14:53:57 -0600
Subject: [PATCH] Protect vault secret with GPG

Encrypting the vault password with GPG protects the key when stored on
disk and allows it to be accessed non-interactively, as long as the
GnuPG agent is set up correctly.
---
 .gitignore       | 1 +
 .vault-secret.sh | 2 ++
 ansible.cfg      | 2 ++
 3 files changed, 5 insertions(+)
 create mode 100755 .vault-secret.sh

diff --git a/.gitignore b/.gitignore
index 4e96927..6a9c6f9 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1,2 @@
+/.vault-secret.gpg
 .fact-cache
diff --git a/.vault-secret.sh b/.vault-secret.sh
new file mode 100755
index 0000000..e6d90b1
--- /dev/null
+++ b/.vault-secret.sh
@@ -0,0 +1,2 @@
+#!/bin/sh
+exec gpg --quiet --batch --decrypt "${0%.sh}.gpg"
diff --git a/ansible.cfg b/ansible.cfg
index 8861b32..a0b6ba4 100644
--- a/ansible.cfg
+++ b/ansible.cfg
@@ -6,3 +6,5 @@ inventory = hosts
 gathering = smart
 fact_caching = jsonfile
 fact_caching_connection = .fact-cache
+
+vault_password_file = .vault-secret.sh