Package: tg-bw-helper
CLI command that connects two awesome tools together - Ansible Vault & Bitwarden Password ManagerTable of ContentsWhy?Getting StartedPrerequisitesInstallationSetting Up With AnsibleUsageCLI OptionsContributingDevelopingOpening MRLicenseWhy?At Thorgate, we deploy project using Ansible. Ansible comes with awesome encrypted storage, and every storage needs it’s own password to access it contents.We also using Bitwarden to store company-wide passwords and sensitive information. And if we already are storing passwords to Ansible Vault’s in Bitwarden, we thought why not use Bitwarden CLI tool to pass these passwords directly to Ansible Vault?And that’s how this project was born 😎Getting StartedPrerequisitesWe need these tools to be installed:Python 3.8+ & PipAnsibleAnsible project that usesAnsible VaultBitwarden AccountBitwarden CLIWe strongly recommend installing Python packages in dedicated and isolated virtual environments. There are several tools that helps manage virtual environments:VirtualenvPipenvPoetry(We will be using this one)InstallationWe assume several things:That you have existing or starting new Ansible projectThat your Ansible installation lives in virtual environmentBased on these assumptions, for installation you need to add this package into your virtual environment. For example you might run$ poetry addtg-bw-helperSetting Up With AnsibleCreate if not yet existing shell script with this example content (it can be namedask-vault-pass.sh) - note that you do not need to addpoetry runbefore invokingbw_helperhere, or activate virtualenv etc., since your ansible will be already running in correct environment#!/bin/shbw_helper--vault-item"Ansible Vault"--vault-item-field"Password"Make sure that this script is executable! If not, run$ sudo chmod +xask-vault-pass.shEditansible.cfgto specify script that Ansible will be using to get Vault password[defaults]vault_password_file=./ask-vault-pass.shUsageNow when all these steps completed:tg-bw-helperis installed into virtual environment where Ansible is installedAnsible project is configured to use special scriptWe are ready to use the tool:Run$ bw login(Needs to be run once per user session)Run your usual Ansible playbook that previously asked for Vault passwordEnter Bitwarden master passwordCLI Options--bw-executableOptional, should point to bw executable, defaults to /usr/bin/bw, can also be set withTG_BW_AP_EXECUTABLE_PATHenv variable--fallback-promptoptional, prompt to display if bw fails, defaults to “Vault password: “, can also be set withTG_BW_AP_FALLBACK_PROMPTenv variable--vault-itemvault item ID or name, should be specific since tool will fail if multiple items are foundItem nameis what you see as it’s name in bitwarden UIItem IDis useful if you have two items with same name, you can learn it by using bitwarden CLI (usebw loginto login, follow the instructions for how to pass the session information over to the next command, and then usebw list items--search<item name>. You will get json array of matching objects, each object will have ID that you can use.)--vault-item-fieldoptional, field to use on the item. If not specified, password is used. Examples:You have an item “Awesome project ansible vault” with password “123”, and you want to use “123”. You do not specify--valut-item-fieldin this case.You have an item “Ansible secrets” with password set to “abc”, that has additional fields “Test server ansible” set to “123” and “Live server ansible” set to “456”, and you want to use “123”. You specify--valut-item-field="Testserver ansible"in this case.ContributingContributions are what make the open source community such an amazing place to learn, inspire, and create. Any contributions you make are greatly appreciated.DevelopingFor local development project repository containspyproject.tomlandpoetry.lock. When using them withPoetryyou will be able to recreate ready to use environment.We also addedMakefilethat contains lots of useful commands to help setup the project, run tests and lint code. Do check it out by runningmakeOpening MRClone the ProjectCreate your Feature Branch (git checkout-bfeature/AmazingFeature)Commit your Changes (git commit-m'Add some AmazingFeature')Push to the Branch (git push origin feature/AmazingFeature)Open a Merge RequestLicenseDistributed under the MIT License. See LICENSE for more information.