• github/getsops/SOPS: Secrets OPerationS
• https://github.com/getsops/sops/releases

• Mozilla Sops для управления секретами в гите

• How to use sops exec-file with docker-compose?

# wget https://github.com/getsops/sops/releases/download/v3.11.0/sops-v3.11.0.linux.amd64

# mv sops-v3.11.0.linux.amd64 /usr/local/bin/sops

# chmod +x /usr/local/bin/sops

# cat vault_example.yml
a: Hello
b: World

# VAULT_ADDR=http://server.corp13.un:8200

#  export VAULT_TOKEN=hKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKU

~/openvpn1# sops encrypt --hc-vault-transit $VAULT_ADDR/v1/transit/keys/ansible-openvpn1 openvpn1/files/server.key #-i

~/openvpn1# cat openvpn1/files/server.key

~/openvpn1# sops decrypt --hc-vault-transit $VAULT_ADDR/v1/transit/keys/ansible-openvpn1 openvpn1/files/server.key #-i

~/openvpn1# cp inventory.yaml inventory4.yaml

~/openvpn1# cat .sops.yaml

creation_rules:
  - path_regex: inventory4.yaml
    encrypted_regex: ^ansible.*pass
    hc_vault_transit_uri: "http://server.corp13.un:8200/v1/transit/keys/ansible-openvpn1"
  - path_regex: openvpn1/files/server.key
    hc_vault_transit_uri: "http://server.corp13.un:8200/v1/transit/keys/ansible-openvpn1"

~/openvpn1# sops encrypt inventory4.yaml -i

~/openvpn1# sops encrypt openvpn1/files/server.key -i

~/openvpn1# cat inventory4.yaml

~/openvpn1# sops edit inventory4.yaml

~/openvpn1# sops exec-file inventory4.yaml 'echo {}; cat {}'

~/openvpn1# sops exec-file --no-fifo inventory4.yaml 'ansible-playbook openvpn1.yaml -i {}'