Setup Ansible
This guide details instructions on how to install and setup ansible so it can be used to deploy to development machines.
Install Ansible
Ansible can be installed as homebrew package:
brew install ansible
Install pass
Pass is an Ubuntu and Mac OS password manager and useful for storing such things as the Ansible vault password, which can then be accessed via scripts. Instructions can be found here: https://macappstore.org/pass/.
Use Homebrew to install:
brew install pass
Setting up pass instructions can be found here: https://linuxhint.com/pass-ubuntu/
You will need to create a PGP key for your password manager. Run the following and hit enter to use all the defaults:
gpg --full-generate-key
Kind: ECC (sign and encrypt)
Curve: 25519
Expiry: Forever
Enter your name and Attestant email address when prompted. Finally enter a strong password that will act as the master password for the vault.
The next step is to get the gpg-id which can be retrieved by running:
gpg --list-keys --keyid-format LONG
>Output
pub ed25519/5BBE26FC8F47E10B 2022-07-25 [SC]
C059DB5CEAFD0DAC731342155AAE26FB7F47E10B
uid [ultimate] Test <test@attestant.io>
sub cv25519/11A632B6650CA8AB 2022-07-25 [E]
Next we can initialise the pass keystore by using the gpg-id:
pass init <gpg-id>
Add pass script for Ansible support
Now you are ready to insert a password into the password manager, example for adding the dev ansible vault password:
pass insert Infrastructure/dev-ansible-vault
<add passphrase>
The final step is to create local scripts to echo the password to Ansible:
In your ~/.zshrc file add the following alias:
alias dev-ansible-playbook='ansible-playbook --vault-password-file $HOME/bin/dev-pass.sh'
Create a local ~/bin directory and add the script, dev-pass.sh:
dev-pass.sh:
#!/bin/bash
echo -n $(pass Infrastructure/dev-ansible-vault)
This will allow the GPG master password to unlock the different vaults for Ansible. Remember to make the script executable with:
chmod +x ~/bin/dev-pass.sh