My Terraform Makefile + scripts

gpg-close.sh

#!/usr/bin/env bash

for a in $(find . -iname "*.asc" -type f) ; do

  # filename without suffix
  FILE="${a%.asc}"

  FILES_TO_ENCRYPT=""
  if [[ -f "${FILE}" ]] && ! md5sum --status -c "${FILE}.md5" || [ "$1" == "-f" ] ; then
    echo "ENCRYPT $FILE"
    FILES_TO_ENCRYPT="$FILES_TO_ENCRYPT $FILE"
  else
    echo "Skipping $FILE"
  fi


  if [[ ! -z "$FILES_TO_ENCRYPT" ]] ; then

    for enc_me in $FILES_TO_ENCRYPT ; do

      # construct -r parameters list - SUPER UGLY
      GPGP=$(cat Makefile-scripts/secrets-enc.txt | grep -Ev "^ *(#.*)?$" | awk '{printf "-r %s ", $1}')

      # actually encrypt the shit
      gpg --encrypt-files -a --yes $GPGP "${enc_me}" # > /dev/null

      # re-calculate md5sum :)
      md5sum $enc_me > $enc_me.md5

      done

  fi

done

gpg-open.sh

#!/usr/bin/env bash

for a in $(find . -iname "*.asc" -type f) ; do

  FILE="${a%.asc}"
  FILES_TO_DECRYPT=""

  if [[ ! -f "${FILE}" || "$a" -nt "${FILE}" ]] ; then
    echo "DECRYPT ${a}"
    FILES_TO_DECRYPT="$FILES_TO_DECRYPT ${a}"
  else
    echo "${FILE} exists and is newer than $a. skipping."
  fi


  if [[ ! -z "$FILES_TO_DECRYPT" ]] ; then

    gpg --decrypt-files --yes $FILES_TO_DECRYPT > /dev/null

    # save md5sum so we can verify if it was modified later.
    for dec_me in $FILES_TO_DECRYPT ; do
      decrypted="${dec_me%.asc}"
      md5sum "${decrypted}" > "${decrypted}.md5"
    done

  fi

done

Makefile

gpg-open:
	Makefile-scripts/gpg-open.sh
.PHONY: gpg-open

gpg-close:
	Makefile-scripts/gpg-close.sh
.PHONY: gpg-close

gpg-reencrypt:
	Makefile-scripts/gpg-open.sh
	Makefile-scripts/gpg-close.sh -f
.PHONY: gpg-reencrypt

all: plan
.PHONY: all

both: plan apply
.PHONY: both

refresh:
	terraform refresh
.PHONY: refresh

quick:
	rm -f terraform.plan ; terraform plan -refresh=false
.PHONY: quick

plan:
	terraform plan -out=terraform.plan ${ARGS}
.PHONY: plan

apply:
	terraform apply terraform.plan ${ARGS} ; rm -f terraform.plan
.PHONY: apply

do: apply
.PHONY: do

destroy:
	terraform destroy
.PHONY: destroy

ashes: destroy
.PHONY: ashes

push:
	git push
.PHONY: push

clean-whitespace:
	Makefile-scripts/whitespace-clean.sh
.PHONY: clean-whitespace

update:
	terraform get -update
.PHONY: update

init:
	terraform init
.PHONY: init