sadv1r / ansible-vault-editor-idea-plugin

Ansible Vault Editor IntelliJ Plugin with auto encryption/decryption
https://plugins.jetbrains.com/plugin/14278-ansible-vault-editor
MIT License
37 stars 5 forks source link

ANSIBLE_VAULT_PASSWORD_FILE is ignored #146

Closed RickS-C137 closed 2 years ago

RickS-C137 commented 2 years ago

Hello there,

I'm using the plugin on a Mac with the environment variable set in my .zshrc. De-/encryption on the command line with the ansivle-vault binary works using the env variable. Sadly the plugin asks me everytime for the password instead of looking it up in the file set in the env variable. I don't get where the problem is. Tried it with a text file contain the cleartext passwords as well as a shell script echoing the password.

sadv1r commented 2 years ago

Hi, thanks for using the plugin.

When you using .zshrc, this variable is only visible inside your bash session. You need to set it globally, so it can be visible inside IDEA plugins.

On Mac OS you can do it like this: launchctl setenv ANSIBLE_VAULT_PASSWORD_FILE ~/passfile.txt

RickS-C137 commented 2 years ago

Yeah, I found that too. This way it isn't reboot safe. For this I've created a launch agent, which is loaded on any boot:

`<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">

Label com.seb.ansible_vault_password ProgramArguments launchctl setenv ANSIBLE_VAULT_PASSWORD_FILE ~/.ansible-vault-password.sh Nice 1 RunAtLoad

The ansible-vault-password.sh reads the password from my MacOS keychain. #!/bin/zsh security find-generic-password -a $USER -s ansible-vault -w`