Configure Ansible Vault for secret management and encryption with playbook automation

#!/usr/bin/env bash
set -euo pipefail

# Colors for output
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
NC='\033[0m' # No Color

# Global variables
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
VAULT_PASSWORD=""
PROJECT_DIR=""

# Usage function
usage() {
    echo "Usage: $0 [OPTIONS]"
    echo "Configure Ansible Vault for secret management and encryption"
    echo ""
    echo "Options:"
    echo "  -p, --password PASSWORD    Set vault password (will prompt if not provided)"
    echo "  -d, --directory DIR        Set project directory (default: current directory)"
    echo "  -h, --help                Show this help message"
    echo ""
    echo "Example: $0 -p 'MyStrongVaultPassword123!' -d /opt/ansible-project"
}

# Error handling and cleanup
cleanup() {
    if [[ $? -ne 0 ]]; then
        echo -e "${RED}[ERROR] Installation failed. Cleaning up...${NC}"
        # Remove potentially corrupted files
        [[ -f ~/.ansible/vault/password ]] && rm -f ~/.ansible/vault/password
        [[ -f ansible.cfg ]] && rm -f ansible.cfg
    fi
}
trap cleanup ERR

# Logging functions
log_info() {
    echo -e "${BLUE}[INFO]${NC} $1"
}

log_success() {
    echo -e "${GREEN}[SUCCESS]${NC} $1"
}

log_warning() {
    echo -e "${YELLOW}[WARNING]${NC} $1"
}

log_error() {
    echo -e "${RED}[ERROR]${NC} $1"
}

# Check if running with appropriate privileges
check_privileges() {
    if [[ $EUID -eq 0 ]]; then
        log_warning "Running as root. This script should typically be run as a regular user."
        read -p "Continue anyway? (y/N): " -n 1 -r
        echo
        if [[ ! $REPLY =~ ^[Yy]$ ]]; then
            exit 1
        fi
    fi
}

# Auto-detect distribution
detect_distro() {
    log_info "Detecting Linux distribution..."
    
    if [[ ! -f /etc/os-release ]]; then
        log_error "Cannot detect distribution. /etc/os-release not found."
        exit 1
    fi
    
    . /etc/os-release
    
    case "$ID" in
        ubuntu|debian)
            PKG_MGR="apt"
            PKG_UPDATE="apt update"
            PKG_INSTALL="apt install -y"
            PYTHON_PKG="python3-pip"
            ;;
        almalinux|rocky|centos|rhel|ol)
            PKG_MGR="dnf"
            PKG_UPDATE="dnf update -y"
            PKG_INSTALL="dnf install -y"
            PYTHON_PKG="python3-pip"
            ;;
        fedora)
            PKG_MGR="dnf"
            PKG_UPDATE="dnf update -y"
            PKG_INSTALL="dnf install -y"
            PYTHON_PKG="python3-pip"
            ;;
        amzn)
            PKG_MGR="yum"
            PKG_UPDATE="yum update -y"
            PKG_INSTALL="yum install -y"
            PYTHON_PKG="python3-pip"
            ;;
        *)
            log_error "Unsupported distribution: $ID"
            exit 1
            ;;
    esac
    
    log_success "Detected: $PRETTY_NAME (Package manager: $PKG_MGR)"
}

# Parse command line arguments
parse_args() {
    while [[ $# -gt 0 ]]; do
        case $1 in
            -p|--password)
                VAULT_PASSWORD="$2"
                shift 2
                ;;
            -d|--directory)
                PROJECT_DIR="$2"
                shift 2
                ;;
            -h|--help)
                usage
                exit 0
                ;;
            *)
                log_error "Unknown option: $1"
                usage
                exit 1
                ;;
        esac
    done
    
    # Set default project directory if not provided
    if [[ -z "$PROJECT_DIR" ]]; then
        PROJECT_DIR="$(pwd)"
    fi
    
    # Validate project directory
    if [[ ! -d "$PROJECT_DIR" ]]; then
        log_error "Project directory does not exist: $PROJECT_DIR"
        exit 1
    fi
    
    # Prompt for password if not provided
    if [[ -z "$VAULT_PASSWORD" ]]; then
        echo -n "Enter vault password (minimum 20 characters): "
        read -s VAULT_PASSWORD
        echo
        
        if [[ ${#VAULT_PASSWORD} -lt 20 ]]; then
            log_error "Password must be at least 20 characters long"
            exit 1
        fi
    fi
}

# Install Ansible and required tools
install_ansible() {
    echo -e "${BLUE}[1/7]${NC} Installing Ansible and required tools..."
    
    # Update package repositories
    sudo $PKG_UPDATE
    
    # Install Ansible and Python pip
    sudo $PKG_INSTALL ansible $PYTHON_PKG
    
    # Install ansible-vault via pip
    pip3 install --user ansible-vault
    
    # Verify installation
    if ! command -v ansible &> /dev/null; then
        log_error "Ansible installation failed"
        exit 1
    fi
    
    log_success "Ansible $(ansible --version | head -n1 | cut -d' ' -f2) installed successfully"
}

# Create vault password file
create_vault_password_file() {
    echo -e "${BLUE}[2/7]${NC} Creating vault password file..."
    
    # Create .ansible/vault directory
    mkdir -p ~/.ansible/vault
    
    # Create password file with restricted permissions
    echo "$VAULT_PASSWORD" > ~/.ansible/vault/password
    chmod 600 ~/.ansible/vault/password
    
    # Verify file permissions
    local perms=$(stat -c "%a" ~/.ansible/vault/password 2>/dev/null || stat -f "%A" ~/.ansible/vault/password)
    if [[ "$perms" != "600" ]]; then
        log_error "Failed to set correct permissions on vault password file"
        exit 1
    fi
    
    log_success "Vault password file created at ~/.ansible/vault/password"
}

# Configure Ansible
configure_ansible() {
    echo -e "${BLUE}[3/7]${NC} Configuring Ansible..."
    
    cd "$PROJECT_DIR"
    
    # Create ansible.cfg
    cat > ansible.cfg << 'EOF'
[defaults]
vault_password_file = ~/.ansible/vault/password
host_key_checking = False
inventory = inventory.ini
timeout = 30
gathering = smart
fact_caching = memory

[ssh_connection]
ssh_args = -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -o ControlMaster=auto -o ControlPersist=30m
pipelining = True
EOF
    
    chmod 644 ansible.cfg
    log_success "Ansible configuration created"
}

# Create directory structure
create_directory_structure() {
    echo -e "${BLUE}[4/7]${NC} Creating project directory structure..."
    
    cd "$PROJECT_DIR"
    
    # Create necessary directories
    mkdir -p group_vars/all
    mkdir -p host_vars
    mkdir -p roles
    mkdir -p templates
    mkdir -p files
    
    # Set proper permissions
    find . -type d -exec chmod 755 {} \;
    
    log_success "Directory structure created"
}

# Create encrypted variables file
create_encrypted_variables() {
    echo -e "${BLUE}[5/7]${NC} Creating encrypted variables file..."
    
    cd "$PROJECT_DIR"
    
    # Create vault.yml with sample encrypted variables
    cat > /tmp/vault_content.yml << 'EOF'
---
# Encrypted sensitive variables
vault_mysql_root_password: "MySecureP@ssw0rd123"
vault_api_key: "sk-1234567890abcdef"
vault_database_url: "postgresql://user:password@localhost:5432/mydb"
vault_ssl_private_key: |
  -----BEGIN PRIVATE KEY-----
  MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQC7
  -----END PRIVATE KEY-----
EOF
    
    # Encrypt the file
    ansible-vault encrypt /tmp/vault_content.yml --output=group_vars/all/vault.yml
    rm /tmp/vault_content.yml
    
    chmod 644 group_vars/all/vault.yml
    log_success "Encrypted variables file created at group_vars/all/vault.yml"
}

# Create public variables file
create_public_variables() {
    echo -e "${BLUE}[6/7]${NC} Creating public variables file..."
    
    cd "$PROJECT_DIR"
    
    cat > group_vars/all/vars.yml << 'EOF'
---
# Public variables that reference vault variables
mysql_root_password: "{{ vault_mysql_root_password }}"
api_key: "{{ vault_api_key }}"
database_url: "{{ vault_database_url }}"
ssl_private_key: "{{ vault_ssl_private_key }}"

# Non-sensitive configuration
mysql_port: 3306
api_endpoint: "https://api.example.com"
ssl_cert_path: "/etc/ssl/certs/example.com.crt"
ssl_key_path: "/etc/ssl/private/example.com.key"
app_user: "appuser"
app_home: "/opt/myapp"
EOF
    
    chmod 644 group_vars/all/vars.yml
    log_success "Public variables file created at group_vars/all/vars.yml"
}

# Create sample inventory and playbook
create_sample_files() {
    echo -e "${BLUE}[7/7]${NC} Creating sample inventory and playbook..."
    
    cd "$PROJECT_DIR"
    
    # Create inventory file
    cat > inventory.ini << 'EOF'
[webservers]
web1 ansible_host=203.0.113.10 ansible_user=ubuntu
web2 ansible_host=203.0.113.11 ansible_user=ubuntu

[databases]
db1 ansible_host=203.0.113.20 ansible_user=ubuntu

[all:vars]
ansible_ssh_private_key_file=~/.ssh/id_rsa
EOF
    
    # Create sample playbook
    cat > site.yml << 'EOF'
---
- name: Deploy application with encrypted secrets
  hosts: webservers
  become: yes
  vars_files:
    - group_vars/all/vars.yml
    - group_vars/all/vault.yml
  
  tasks:
    - name: Install required packages
      package:
        name:
          - nginx
          - python3
        state: present
    
    - name: Create application user
      user:
        name: "{{ app_user }}"
        shell: /bin/bash
        home: "{{ app_home }}"
        system: yes
    
    - name: Create SSL certificate directory
      file:
        path: /etc/ssl/private
        state: directory
        mode: '0700'
        owner: root
        group: root
    
    - name: Display encrypted variable (for testing)
      debug:
        msg: "MySQL password is configured (length: {{ mysql_root_password | length }})"
EOF
    
    chmod 644 inventory.ini site.yml
    log_success "Sample inventory and playbook created"
}

# Verify installation
verify_installation() {
    echo -e "${BLUE}Verifying Ansible Vault installation...${NC}"
    
    cd "$PROJECT_DIR"
    
    # Test vault password file
    if [[ ! -f ~/.ansible/vault/password ]]; then
        log_error "Vault password file not found"
        return 1
    fi
    
    # Test vault file decryption
    if ! ansible-vault view group_vars/all/vault.yml > /dev/null 2>&1; then
        log_error "Cannot decrypt vault file"
        return 1
    fi
    
    # Test playbook syntax
    if ! ansible-playbook --syntax-check site.yml > /dev/null 2>&1; then
        log_error "Playbook syntax check failed"
        return 1
    fi
    
    log_success "All verification checks passed"
    
    echo
    echo -e "${GREEN}Ansible Vault setup completed successfully!${NC}"
    echo
    echo "Next steps:"
    echo "1. Update inventory.ini with your actual server IPs"
    echo "2. Edit group_vars/all/vault.yml to add your secrets:"
    echo "   ansible-vault edit group_vars/all/vault.yml"
    echo "3. Test the playbook:"
    echo "   ansible-playbook site.yml --check"
    echo
    echo "Project directory: $PROJECT_DIR"
    echo "Vault password file: ~/.ansible/vault/password"
}

# Main function
main() {
    echo -e "${GREEN}Ansible Vault Installation Script${NC}"
    echo "=================================="
    
    check_privileges
    detect_distro
    parse_args "$@"
    install_ansible
    create_vault_password_file
    configure_ansible
    create_directory_structure
    create_encrypted_variables
    create_public_variables
    create_sample_files
    verify_installation
}

# Run main function with all arguments
main "$@"