Ansible vault transparent encryption revisited

clean_vault

#!/bin/sh

if [ ! -r '.vault_password' ]; then
  exit 1
fi

tmp=`mktemp`
cat > $tmp

ansible-vault encrypt $tmp --vault-password-file=.vault_password > /dev/null 2>&1

cat "$tmp"
rm $tmp

diff_vault

#!/bin/sh

if [ ! -r '.vault_password' ]; then
  exit 1
fi

export PAGER='cat'
CONTENT=`ansible-vault view "$1" --vault-password-file=.vault_password 2> /dev/null`

if grep -q 'ERROR: data is not encrypted' "$CONTENT"; then
  cat "$1"
else
  echo "$CONTENT"
fi

smudge_vault

#!/bin/sh

if [ ! -r '.vault_password' ]; then
  exit 1
fi

tmp=`mktemp`
cat > $tmp

export PAGER='cat'
CONTENT=`ansible-vault view "$tmp" --vault-password-file=.vault_password 2> /dev/null`

if grep -q 'ERROR: data is not encrypted' $CONTENT; then
  echo "Looks like one file was commited clear text"
  echo "Please fix this before continuing !"
  exit 1
else
  echo $CONTENT
fi

rm $tmp