Simple wrapper script to unseal a vault server with encrypted seal keys

vault-unseal.sh

#!/bin/bash -e

# Simple wrapper script to unseal a vault server with encrypted seals

read -rp 'Decrypt method [keybase|gpg]: ' method

case "${method}" in
gpg)
  cmd="gpg -dq"
  ;;
keybase)
  cmd="keybase pgp decrypt"
  ;;
*)
  echo "Only gpg or keybase are accepted"
  exit 1;
  ;;
esac

read -rsp 'Encrypted unseal key: ' encrypted_seal
decrypted=$(echo "${encrypted_seal}" | base64 -d | ${cmd})

read -rp 'Give vault addr, e.g. "https://vault.example.com:8200" : ' address

vault operator unseal -address="${address}" "${decrypted}"