💡 Feature Request: Add ability to use vault pass lookup plugins by default.

[chrillep]

Summary

We use 1pass to fetch vault_pass string and store it to file. If we could skip this step it would be "one less" thing to have to handle.

With that said. I would love if Trellis would provide an out of the box solution to handling vault_pass "not on file".

AC:

• Trellis should be able to handle lookup provider by default
• Trellis should be able to handle lookup value based on provider by default
• If not setting provider Trellis should work as before

refs:

• https://eengstrom.github.io/musings/ansible-sudo-var
• https://docs.ansible.com/ansible/latest/collections/community/general/onepassword_lookup.html
• https://discourse.roots.io/t/best-way-to-share-trellis-and-bedrock-configuration/12712/5

Additional context

No response

[swalkinshaw]

I don't think there's anything Trellis needs to do here. Trellis defaults to Ansible's default which is a .vault_pass file. You can easily edit the Ansible config file to specify a custom vault pass which can also be a shell script!

Here's a good tutorial I found: https://www.inetsix.net/posts/Ansible-vault-1password/

[chrillep]

I don't think there's anything Trellis needs to do here. Trellis defaults to Ansible's default which is a .vault_pass file. You can easily edit the Ansible config file to specify a custom vault pass which can also be a shell script!

Here's a good tutorial I found: https://www.inetsix.net/posts/Ansible-vault-1password/

Yeah sorry! Im really not connecting the dots here. Brain 🧠 not firing good this morning.

step

1. set ansible.cfg > vault_password_file to ...

but i get you don't want to stray from the defaults.

[swalkinshaw]

set ansible.cfg > vault_password_file to

vault_password_file=ansible_vault_1p_password

ansible_vault_1p_password is a shell script (in your $PATH somewhere) which uses the 1p CLI to get the password.

but i get you don't want to stray from the defaults.

We use the defaults to make it easier for people with a use case like one to follow Ansible's docs and standard ways of customization 😄