Answers: <p>I just had the same want for my personal learning experience (home-lab).  What I found was the .git/hooks/pre-commit would help.  I have not automated the process, so for your inspiration here are the parts I have.</p>
  <p>The .git/hooks/pre-commit is a bash script.  The FILE_PATTERN variable determines the files I want to find and warn about are not ansible-vault encrypted.  FOr me that would be all yaml files containing variables I don't want to share.</p>
  <pre><code>#!/bin/sh
  #
  # Ansible Vault Secrets Git Hook
  #
  # Hook to check if an un-encrypted FILE_PATTERN file is being commited. Useful if secrets 
  # are retained in ansible vault encrypted file(s) that should never be committed to the repository
  # un-encrypted. Contact a repository owner for the ansible vault password.
  #
  # Put this file in .git/hooks/pre-commit
  
  # set -o xtrace
  set -o nounset
  
  FILE_PATTERN=&quot;my_secrets_file.yaml\|vars/&quot;
  ENCRYPTED_PATTERN=&quot;\$ANSIBLE_VAULT&quot;
  
  is_encrypted() {
    local file=$1
    if ! git show :&quot;$file&quot; | grep --quiet &quot;^${ENCRYPTED_PATTERN}&quot;; then
      echo &quot;Located a staged file that should be encrypted:\n&gt; ${file}\n&quot;
      echo &quot;Please un-stage this file. If you are adding or updating this file, please encrypt it before staging.&quot;
      echo &quot;Alternatively, you can git checkout the latest encrypted version of the file before committing.\n&quot;
      echo &quot;Remember... Only YOU Can Prevent Secret Leakage.&quot;
      exit 1
    fi
  }
  
  echo &quot;Running pre-commit checks...&quot;
  git diff --cached --name-only | grep &quot;${FILE_PATTERN}&quot; | while IFS= read -r line; do
    is_encrypted &quot;${line}&quot;
  done
  </code></pre>
  <p>This solves part 1 - i.e. letting me know that I have secrets about to get committed and stopping the misery right there.  A simple &quot;git commit&quot; will get this caught.~</p>
  <p>The 2nd part is encrypting the necessary files.  This is simply a matter of again finding the relevant files and encrypting these.  I have made this script to put some convenience into this.  The 'files' variable contains the (same) patterns to look for the files.</p>
  <pre><code>#!/bin/bash
  
  # If number of arguments is 0
  if [ $# -eq 0 ]
    then
      echo &quot;This script will encrypt of decrypt all files containing secrets.&quot;
      echo &quot;There are all files in vars as well as all secrets.yaml files under each service.&quot;
      echo &quot;Specify 'decrypt' or 'encrypt' as argument&quot;
      echo &quot;If you put the vault password in a password file named .vault_password, the script will not ask for a password.&quot;
      exit 1
  fi
  
  files=`find . -type f -name &quot;me_secrets_file.yaml&quot;`
  files=&quot;$files vars/*&quot;
  
  password_type=--ask-vault-password
  if [ -f &quot;.vault_password&quot; ]
    then
      if [ `stat -c %a .vault_password` != &quot;600&quot; ]
        then
          echo &quot;.vault_password file has bad permissions; fixing this to 600&quot;
          chmod 600 .vault_password
      fi
      password_type=&quot;--vault-password-file .vault_password&quot;
  fi
  
  if [ $1 == &quot;encrypt&quot; ]
    then
      ansible-vault encrypt $password_type $files
      for value in $files; do
          echo $value;
      done
  
  elif [ $1 == &quot;decrypt&quot; ]
    then
      ansible-vault decrypt $password_type $files
      for value in $files; do
          echo $value;
      done
  else
      echo &quot;Wrong argument supplied.  Run without arguments to see allowed ones.&quot;
  fi
  </code></pre>
  <p>Used as:</p>
  <pre><code>./vault.sh {encrypt|decrypt}
  </code></pre>
  <p>This solves part 2 - encryption/decryption of the necessary files.</p>
  <p>I am sure these two parts can be combined so that encryption happens as part of the pre-commit hook on any file which is not already encrypted.
  Improve by putting -´.vault_password in ~/.vault_password and so on.</p>
  <p>The pre-commit script is not originally of my doing, but I did not save the reference.</p>
  
Answers: CC BY-SA 4.0
Answers: 2022-07-23T10:22:38.370Z
Answers: 2022-07-23T10:22:38.370Z
Answers: Kim Poulsen
Body: <p>I'm trying to use ansible-vault to secure the secret files in my project before I push them to Git.
  There's loads of advice out there on how to set this up in part, but everything I've read is specifically for diff'ing these files, not how to encrypt them as you put them in - it looks like to initially commit them you need to manually vault them first. Is there a way of doing this vaulting on the fly?</p>
  <p>What I have so far:
  .git/config:</p>
  <pre><code> [diff &quot;ansible-vault&quot;]
   textconv = &quot;ansible-vault view&quot;
  </code></pre>
  <p>ansible.cfg:</p>
  <pre><code> [defaults]
   vault_password_file = .vault
  </code></pre>
  <p>.gitattributes:</p>
  <pre><code>key.pem diff=ansible-vault merge=binary
  </code></pre>
  <p>This works fine if I run the following commands:</p>
  <pre><code> ansible-vault encrypt key.pem 
   git add key.pem
   ansible-vault decrypt key.pem 
   git diff --cached
  </code></pre>
  <p>I'd like to automate the ansible-vault encrypt/decrypt commands within git. Any ideas?</p>
  
Comments: CC BY-SA 4.0
Comments: 2022-07-20T11:45:26.293Z
Comments: Thinking about this, am I using ansible-vault for the wrong purpose here? I guess generally you'd have a playbook reading the vaulted files, so the files being vaulted is what you want here. What I'm trying to do here is use vault just as an encryption tool. (Would still be nice to be able to do this, though)
Comments: Jim ReesPotter
Comments: CC BY-SA 4.0
Comments: 2022-07-21T13:45:28.197Z
Comments: I think you're looking for something like [this](https://developers.redhat.com/articles/2022/02/02/protect-secrets-git-cleansmudge-filter), but using ansible-vault instead of gpg.
Comments: larsks
Tags: <git><ansible-vault>
Title: How to ansible-vault files as they are commited to Git
UserDisplayName: Jim ReesPotter
ThreadText: # How to ansible-vault files as they are commited to Git
  
  (Asked by: username_0 on 2022-07-20)
  
  I'm trying to use ansible-vault to secure the secret files in my project before I push them to Git.
  There's loads of advice out there on how to set this up in part, but everything I've read is specifically for diff'ing these files, not how to encrypt them as you put them in - it looks like to initially commit them you need to manually vault them first. Is there a way of doing this vaulting on the fly?
  
  What I have so far:
  .git/config:
  
  ```
   [diff "ansible-vault"]
   textconv = "ansible-vault view"
  
  ```
  
  ansible.cfg:
  
  ```
   [defaults]
   vault_password_file = .vault
  
  ```
  
  .gitattributes:
  
  ```
  key.pem diff=ansible-vault merge=binary
  
  ```
  
  This works fine if I run the following commands:
  
  ```
   ansible-vault encrypt key.pem 
   git add key.pem
   ansible-vault decrypt key.pem 
   git diff --cached
  
  ```
  
  I'd like to automate the ansible-vault encrypt/decrypt commands within git. Any ideas?
  
  **Tags:** git, ansible-vault
  
  > **Comments:**
  > **username_0**: Thinking about this, am I using ansible-vault for the wrong purpose here? I guess generally you'd have a playbook reading the vaulted files, so the files being vaulted is what you want here. What I'm trying to do here is use vault just as an encryption tool. (Would still be nice to be able to do this, though)  
  > **username_1**: I think you're looking for something like [this](https://developers.redhat.com/articles/2022/02/02/protect-secrets-git-cleansmudge-filter), but using ansible-vault instead of gpg.  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_2 on 2022-07-23. Score: 5
  
  I just had the same want for my personal learning experience (home-lab). What I found was the .git/hooks/pre-commit would help. I have not automated the process, so for your inspiration here are the parts I have.
  
  The .git/hooks/pre-commit is a bash script. The FILE\_PATTERN variable determines the files I want to find and warn about are not ansible-vault encrypted. FOr me that would be all yaml files containing variables I don't want to share.
  
  ```
  #!/bin/sh
  #
  # Ansible Vault Secrets Git Hook
  #
  # Hook to check if an un-encrypted FILE_PATTERN file is being commited. Useful if secrets 
  # are retained in ansible vault encrypted file(s) that should never be committed to the repository
  # un-encrypted. Contact a repository owner for the ansible vault password.
  #
  # Put this file in .git/hooks/pre-commit
  
  # set -o xtrace
  set -o nounset
  
  FILE_PATTERN="my_secrets_file.yaml\|vars/"
  ENCRYPTED_PATTERN="\$ANSIBLE_VAULT"
  
  is_encrypted() {
    local file=$1
    if ! git show :"$file" | grep --quiet "^${ENCRYPTED_PATTERN}"; then
      echo "Located a staged file that should be encrypted:\n> ${file}\n"
      echo "Please un-stage this file. If you are adding or updating this file, please encrypt it before staging."
      echo "Alternatively, you can git checkout the latest encrypted version of the file before committing.\n"
      echo "Remember... Only YOU Can Prevent Secret Leakage."
      exit 1
    fi
  }
  
  echo "Running pre-commit checks..."
  git diff --cached --name-only | grep "${FILE_PATTERN}" | while IFS= read -r line; do
    is_encrypted "${line}"
  done
  
  ```
  
  This solves part 1 - i.e. letting me know that I have secrets about to get committed and stopping the misery right there. A simple "git commit" will get this caught.~
  
  The 2nd part is encrypting the necessary files. This is simply a matter of again finding the relevant files and encrypting these. I have made this script to put some convenience into this. The 'files' variable contains the (same) patterns to look for the files.
  
  ```
  #!/bin/bash
  
  # If number of arguments is 0
  if [ $# -eq 0 ]
    then
      echo "This script will encrypt of decrypt all files containing secrets."
      echo "There are all files in vars as well as all secrets.yaml files under each service."
      echo "Specify 'decrypt' or 'encrypt' as argument"
      echo "If you put the vault password in a password file named .vault_password, the script will not ask for a password."
      exit 1
  fi
  
  files=`find . -type f -name "me_secrets_file.yaml"`
  files="$files vars/*"
  
  password_type=--ask-vault-password
  if [ -f ".vault_password" ]
    then
      if [ `stat -c %a .vault_password` != "600" ]
        then
          echo ".vault_password file has bad permissions; fixing this to 600"
          chmod 600 .vault_password
      fi
      password_type="--vault-password-file .vault_password"
  fi
  
  if [ $1 == "encrypt" ]
    then
      ansible-vault encrypt $password_type $files
      for value in $files; do
          echo $value;
      done
  
  elif [ $1 == "decrypt" ]
    then
      ansible-vault decrypt $password_type $files
      for value in $files; do
          echo $value;
      done
  else
      echo "Wrong argument supplied.  Run without arguments to see allowed ones."
  fi
  
  ```
  
  Used as:
  
  ```
  ./vault.sh {encrypt|decrypt}
  
  ```
  
  This solves part 2 - encryption/decryption of the necessary files.
  
  I am sure these two parts can be combined so that encryption happens as part of the pre-commit hook on any file which is not already encrypted.
  Improve by putting -´.vault\_password in ~/.vault\_password and so on.
  
  The pre-commit script is not originally of my doing, but I did not save the reference.
  
  
  ---
  
  