ansible-vault-lastpass

#!/bin/bash

# SPDX-License-Identifier: GPL-3.0-only
# Copyright 2018, Mattias Bengtsson <mattias.jc.bengtsson@gmail.com>

LASTPASS_ACCOUNT=mattias.jc.bengtsson@gmail.com
LASTPASS_GROUP=AnsibleVaults

ANSIBLE_CALL=false

# shellcheck disable=SC2009
case "$(ps aux | grep "${PPID}" | awk "\$2 == ${PPID} {print \$11, \$12}")" in
    *ansible-playbook*)
        ANSIBLE_CALL=true
        ;;
    *)
        ANSIBLE_CALL=false
        ;;
esac

function strip-dot-git {
    case "${1}" in
        *.git) echo "${1%.*}" ;;
        *)     echo "${1}"    ;;
    esac
}

function strip-username {
    case "${1}" in
        *@*) echo "${1##*@}" ;;
        *)   echo "${1}"     ;;
    esac
}

function git-get-hostname-from-remote {
    url="$(strip-dot-git "${1}")"
    case "${url}" in
        http://*|https://*)
            IFS='/'
            read -ra split <<< "${url}"
            strip-username "${split[*]:2:1}"
            ;;
        *:*)
            IFS=':'
            read -ra split <<< "${url}"
            strip-username "${split[*]:0:1}"
            ;;
        *)
            error "Weird remote: [${url}]"
            ;;
    esac
}

function git-get-project-from-remote {
    url="$(strip-dot-git "${1}")"
    case "${url}" in
        http://*|https://*)
            IFS='/'
            read -ra split <<< "${url}"
            echo "${split[*]:3}"
            ;;
        *:*)
            IFS=':'
            read -ra split <<< "${url}"
            echo "${split[*]:1}"
            ;;
        *)
            error "Weird remote: [${url}]"
            ;;
    esac
}

function error {
    if [ "${ANSIBLE_CALL}" = true ]; then
        echo "${@}" | systemd-cat -p err
    else
        echo "${@}" > /dev/stderr
    fi
}

function usage {
    echo "Usage: $(basename "${0}") [-h|--help] [add|edit|generate|rm]"
    echo
    echo "Store passwords for ansible-vault in lastpass."
}

function full-usage {
    usage
    echo
    echo "Notes:"
    echo
    echo "  $(basename "${0}") assumes the vault file is sitting in a"
    echo "  git-repository with a configured upstream- or origin remote."
    echo
    echo "Quick start:"
    echo
    echo "  Inside a git-repo:"
    echo "    $ export ANSIBLE_VAULT_PASSWORD_FILE=${0}"
    echo "    $ $(basename "${0}") generate"
    echo
    echo "  After typing in your password and closing your editor you should now"
    echo "  have the vault password for this repo stored in lastpass under the "
    echo "  ${LASTPASS_GROUP} group."
    echo
    echo "  If everything works as expected all ansible-vault commands"
    echo "  (inside the same repo) should now fetch this password from lastpass."
}

function check-args {
    if [ $# -lt 1 ]; then
        return 0
    fi
    case "${1}" in
        add|edit|generate|rm)
            return 0
            ;;
        *)
            return 2
            ;;
    esac
}

if [[ " ${*} " == *" -h "* ]]; then
    usage
    exit 0
elif [[ " ${*} " == *" --help "* ]]; then
    full-usage
    exit 0
elif ! check-args "${@}"; then
    error "'${1}' is not a known command. See '$(basename "${0}") --help'."
    exit 2
fi

if [ ! "$(git rev-parse --is-inside-work-tree 2>/dev/null)" = "true" ]; then
    # TODO: make it possible to fall back to other method.
    echo "$(basename "${0}"): not a git repository"
    exit 0
fi

# TODO: Thin about how to output stuff here. Maybe pipe to some info function
# that either sends it to the journal or to stdout/stderr
if ! lpass status -q &>/dev/null; then
    if ! lpass login "${LASTPASS_ACCOUNT}" &>/dev/null; then
        error "Failed to login to lastpass"
        exit 4
    fi
fi

# TODO: Thin about how to output stuff here. Maybe pipe to some error function
# that either sends it to the journal or to stdout/stderr
if ! remote=$(git remote get-url upstream 2>/dev/null); then
    if ! remote=$(git remote get-url origin 2>/dev/null); then
        error "Failed to find a suitable remote"
        exit 5
    fi
fi

host="$(git-get-hostname-from-remote "${remote}")"
project="$(git-get-project-from-remote "${remote}")"
key="${LASTPASS_GROUP}\\${host}\\${project}"

if [ $# -gt 0 ]; then
    case "${1}" in
        add|generate)
            lpass show --username "${key}" &> /dev/null && {
                error "The '${key}' key already exists!"
                exit 6
            }
            case "${1}" in
                add)
                    lpass add --password "${key}"
                    ;;
                generate)
                    lpass generate "${key}" 15 > /dev/null
                    ;;
            esac
            ;;
        edit|rm)
            lpass show --username "${key}" &>/dev/null || {
                error "The '${key}' key doesn't exist!"
                exit 7
            }
            case "${1}" in
                edit)
                    lpass edit --password "${key}"
                 ;;
                rm)
                    read -p "Are you sure you want to delete ${key} [y/N]?"    \
                         -n 1                                                  \
                         -r
                    echo
                    if [[ $REPLY =~ ^[Yy]$ ]]; then
                        lpass rm "${key}"
                    fi
                    ;;
            esac
            ;;
    esac
else
    lpass show --password "${key}"
fi