Sascha
bc765668a6
Nachgezogener Arbeitsstand des Homelabs: - neue host_vars (k3s-*, gluster-*, docmost, paperless, kometa, thelounge, satisfactory, wolfstack-vm) - neue Rollen/Playbooks (net_watchdog, patchmon-agent, tc_ratelimit, sops-age, rotate-ssh-key, dns-doh, remove-postfix, checkrr-deploy) - diverse Rollen-Updates (base, borg, dns_resolver, frp_client, hawser, nvidia) Ausgeklammert (bleiben uncommittet): host_vars/docmost/vars.yml (Klartext-Token -> sollte vault-konform via vault_* referenziert werden). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
40 lines
1.3 KiB
YAML
40 lines
1.3 KiB
YAML
---
|
|
- name: SOPS + Age Key Deployment
|
|
hosts: all
|
|
become: yes
|
|
tasks:
|
|
- name: sops installieren
|
|
ansible.builtin.shell: |
|
|
if ! command -v sops &>/dev/null; then
|
|
curl -sLo /usr/local/bin/sops https://github.com/getsops/sops/releases/download/v3.12.2/sops-v3.12.2.linux.amd64
|
|
chmod +x /usr/local/bin/sops
|
|
fi
|
|
args:
|
|
creates: /usr/local/bin/sops
|
|
|
|
- name: Age Key Verzeichnis erstellen
|
|
ansible.builtin.file:
|
|
path: /root/.config/sops/age
|
|
state: directory
|
|
mode: "0700"
|
|
|
|
- name: Age Key deployen
|
|
ansible.builtin.copy:
|
|
content: |
|
|
# created: 2026-04-04T09:42:26+02:00
|
|
# public key: age1z8gak2l4h0vpcnhtcdxmem2u9h2n54vuksk8ys82609qtzampuvqh50wdr
|
|
AGE-SECRET-KEY-19RPRZ89VNDR6KECR7ULA38P8KJ7FHMXJ9N07UUJHLGSVMUW69LHS89XDD2
|
|
dest: /root/.config/sops/age/keys.txt
|
|
mode: "0600"
|
|
|
|
- name: sops decrypt Hook fuer Git-Repos erstellen
|
|
ansible.builtin.copy:
|
|
content: |
|
|
#!/bin/bash
|
|
# Post-merge hook: decrypt .env.enc after git pull
|
|
if [ -f .env.enc ]; then
|
|
sops -d --input-type dotenv --output-type dotenv .env.enc > .env
|
|
echo "[sops] .env decrypted"
|
|
fi
|
|
dest: /usr/local/bin/sops-decrypt-env
|
|
mode: "0755"
|