PhilandClaude Opus 5.5
0875389d02
Deploys from unpushed branches were being reverted by the next deploy from main, and in-place vault edits could overwrite each other. - deploy-guard.yml (imported by site.yml and dns.yml) refuses real runs unless the checkout is clean and exactly origin/main; --check is fine. - bin/deploy holds a lock so only one deploy runs at a time. - bin/vault-run edits the vault under a lock with an atomic swap. - bin/worktree starts a task in a fresh worktree from origin/main. - CLAUDE.md explains the workflow. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
26 lines
1.3 KiB
Bash
Executable File
26 lines
1.3 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Edit the shared vault safely: lock, back up, decrypt to a private temp file,
|
|
# run your command on it, check the YAML, re-encrypt, and swap it in at once.
|
|
# The command gets the plaintext path as $VAULT_PLAIN (also appended as the
|
|
# last argument). Never use `ansible-vault edit`.
|
|
# bin/vault-run python3 my_edit.py
|
|
# bin/vault-run nvim
|
|
set -euo pipefail
|
|
. "$(dirname "$0")/_common.sh"
|
|
[ $# -gt 0 ] || { echo "usage: bin/vault-run <command...>" >&2; exit 2; }
|
|
vault="$main_checkout/group_vars/all/vault.yml"
|
|
pass="$main_checkout/vault_pass"
|
|
av="$main_checkout/.venv/bin/ansible-vault"
|
|
take_lock vault
|
|
backups="$HOME/Documents/backups/ansible-vault"; mkdir -p "$backups"
|
|
cp -p "$vault" "$backups/vault.yml.$(date +%Y%m%d-%H%M%S)"
|
|
tmp=$(mktemp -d "$lock_dir/vault.XXXXXX"); trap 'shred -u "$tmp"/* 2>/dev/null; rm -rf "$tmp"' EXIT
|
|
export VAULT_PLAIN="$tmp/vault.yml"
|
|
"$av" decrypt --vault-password-file "$pass" --output "$VAULT_PLAIN" "$vault" >/dev/null
|
|
"$@" "$VAULT_PLAIN"
|
|
"$main_checkout/.venv/bin/python" -c 'import sys,yaml; yaml.safe_load(open(sys.argv[1]))' "$VAULT_PLAIN"
|
|
"$av" encrypt --vault-password-file "$pass" --output "$tmp/vault.enc" "$VAULT_PLAIN" >/dev/null
|
|
chmod --reference="$vault" "$tmp/vault.enc" 2>/dev/null || true
|
|
mv "$tmp/vault.enc" "$vault"
|
|
echo "vault updated"
|