363 lines
9.1 KiB
Bash
Executable File
363 lines
9.1 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# ============================================================================
|
|
# Dotfiles Secrets Vault (Arch/CachyOS)
|
|
# ============================================================================
|
|
|
|
set -e
|
|
|
|
readonly VAULT_DIR="${HOME}/.dotfiles/vault"
|
|
readonly VAULT_FILE="${VAULT_DIR}/secrets.enc"
|
|
|
|
# Color codes
|
|
readonly RED='\033[0;31m'
|
|
readonly GREEN='\033[0;32m'
|
|
readonly YELLOW='\033[1;33m'
|
|
readonly BLUE='\033[0;34m'
|
|
readonly CYAN='\033[0;36m'
|
|
readonly NC='\033[0m'
|
|
|
|
# ============================================================================
|
|
# MOTD-style header
|
|
# ============================================================================
|
|
|
|
_M_WIDTH=66
|
|
|
|
print_header() {
|
|
local user="${USER:-root}"
|
|
local hostname="${HOSTNAME:-$(hostname -s 2>/dev/null)}"
|
|
local script_name="dotfiles-vault"
|
|
local datetime=$(date '+%a %b %d %H:%M')
|
|
|
|
# Colors
|
|
local _M_RESET=$'\033[0m'
|
|
local _M_BOLD=$'\033[1m'
|
|
local _M_DIM=$'\033[2m'
|
|
local _M_BLUE=$'\033[38;5;39m'
|
|
local _M_GREY=$'\033[38;5;242m'
|
|
|
|
# Build horizontal line
|
|
local hline=""
|
|
for ((i=0; i<_M_WIDTH; i++)); do hline+="═"; done
|
|
local inner=$((_M_WIDTH - 2))
|
|
|
|
# Header content
|
|
local h_left="✦ ${user}@${hostname}"
|
|
local h_center="${script_name}"
|
|
local h_right="${datetime}"
|
|
local h_pad=$(((inner - ${#h_left} - ${#h_center} - ${#h_right}) / 2))
|
|
local h_spaces=""
|
|
for ((i=0; i<h_pad; i++)); do h_spaces+=" "; done
|
|
|
|
echo ""
|
|
echo -e "${_M_GREY}╒${hline}╕${_M_RESET}"
|
|
echo -e "${_M_GREY}│${_M_RESET} ${_M_BOLD}${_M_BLUE}${h_left}${_M_RESET}${h_spaces}${_M_DIM}${h_center}${h_spaces}${h_right}${_M_RESET} ${_M_GREY}│${_M_RESET}"
|
|
echo -e "${_M_GREY}╘${hline}╛${_M_RESET}"
|
|
echo ""
|
|
}
|
|
|
|
# ============================================================================
|
|
# Helper functions
|
|
# ============================================================================
|
|
|
|
print_success() {
|
|
echo -e "${GREEN}✓${NC} $1"
|
|
}
|
|
|
|
print_error() {
|
|
echo -e "${RED}✗${NC} $1" >&2
|
|
}
|
|
|
|
print_section() {
|
|
echo ""
|
|
echo -e "${BLUE}▶${NC} $1"
|
|
}
|
|
|
|
# ============================================================================
|
|
# Encryption/Decryption
|
|
# ============================================================================
|
|
|
|
get_cipher() {
|
|
if command -v age &> /dev/null; then
|
|
echo "age"
|
|
elif command -v gpg &> /dev/null; then
|
|
echo "gpg"
|
|
else
|
|
print_error "No encryption tool available (install age or gpg)"
|
|
exit 1
|
|
fi
|
|
}
|
|
|
|
init_vault() {
|
|
print_section "Initializing Vault"
|
|
|
|
mkdir -p "$VAULT_DIR"
|
|
chmod 700 "$VAULT_DIR"
|
|
|
|
if [[ ! -f "$VAULT_FILE" ]]; then
|
|
# Create empty encrypted file
|
|
echo "{}" | $(get_cipher) > "$VAULT_FILE"
|
|
print_success "Vault initialized"
|
|
else
|
|
print_success "Vault already exists"
|
|
fi
|
|
}
|
|
|
|
decrypt_vault() {
|
|
if [[ ! -f "$VAULT_FILE" ]]; then
|
|
echo "{}"
|
|
return
|
|
fi
|
|
|
|
local cipher=$(get_cipher)
|
|
|
|
case "$cipher" in
|
|
age)
|
|
age -d -i "$HOME/.age/keys.txt" "$VAULT_FILE" 2>/dev/null || echo "{}"
|
|
;;
|
|
gpg)
|
|
gpg --decrypt "$VAULT_FILE" 2>/dev/null || echo "{}"
|
|
;;
|
|
esac
|
|
}
|
|
|
|
encrypt_vault() {
|
|
local data="$1"
|
|
local cipher=$(get_cipher)
|
|
|
|
case "$cipher" in
|
|
age)
|
|
echo "$data" | age -R "$HOME/.age/keys.txt" > "$VAULT_FILE"
|
|
;;
|
|
gpg)
|
|
echo "$data" | gpg --encrypt --armor > "$VAULT_FILE"
|
|
;;
|
|
esac
|
|
}
|
|
|
|
# ============================================================================
|
|
# Vault operations
|
|
# ============================================================================
|
|
|
|
vault_set() {
|
|
local key="$1"
|
|
local value="${2:-}"
|
|
|
|
if [[ -z "$key" ]]; then
|
|
print_error "Usage: vault set <key> [value]"
|
|
exit 1
|
|
fi
|
|
|
|
# Get value from stdin if not provided
|
|
if [[ -z "$value" ]]; then
|
|
read -s -p "Enter value for $key: " value
|
|
echo ""
|
|
fi
|
|
|
|
# Decrypt current vault
|
|
local current=$(decrypt_vault)
|
|
|
|
# Add new key-value pair (using jq if available, otherwise simple replacement)
|
|
if command -v jq &> /dev/null; then
|
|
local updated=$(echo "$current" | jq --arg k "$key" --arg v "$value" '.[$k] = $v')
|
|
else
|
|
# Simple fallback without jq
|
|
local updated="{\"$key\": \"$value\"}"
|
|
fi
|
|
|
|
# Encrypt and save
|
|
encrypt_vault "$updated"
|
|
print_success "Secret stored: $key"
|
|
}
|
|
|
|
vault_get() {
|
|
local key="$1"
|
|
|
|
if [[ -z "$key" ]]; then
|
|
print_error "Usage: vault get <key>"
|
|
exit 1
|
|
fi
|
|
|
|
local vault=$(decrypt_vault)
|
|
|
|
if command -v jq &> /dev/null; then
|
|
echo "$vault" | jq -r ".\"$key\" // \"\"" | grep -v "^$"
|
|
else
|
|
# Simple grep fallback
|
|
echo "$vault" | grep "\"$key\"" | cut -d'"' -f4
|
|
fi
|
|
}
|
|
|
|
vault_list() {
|
|
print_section "Secrets"
|
|
|
|
local vault=$(decrypt_vault)
|
|
|
|
if command -v jq &> /dev/null; then
|
|
echo "$vault" | jq -r 'keys[]' | while read key; do
|
|
echo -e " ${CYAN}•${NC} $key"
|
|
done
|
|
else
|
|
# Simple fallback
|
|
echo "$vault" | grep -o '"[^"]*":' | sed 's/"//g' | sed 's/:$//' | while read key; do
|
|
echo -e " ${CYAN}•${NC} $key"
|
|
done
|
|
fi
|
|
|
|
echo ""
|
|
}
|
|
|
|
vault_delete() {
|
|
local key="$1"
|
|
|
|
if [[ -z "$key" ]]; then
|
|
print_error "Usage: vault delete <key>"
|
|
exit 1
|
|
fi
|
|
|
|
local vault=$(decrypt_vault)
|
|
|
|
if command -v jq &> /dev/null; then
|
|
local updated=$(echo "$vault" | jq "del(.\"$key\")")
|
|
else
|
|
print_error "jq required for delete operation"
|
|
exit 1
|
|
fi
|
|
|
|
encrypt_vault "$updated"
|
|
print_success "Secret deleted: $key"
|
|
}
|
|
|
|
vault_shell() {
|
|
print_section "Loading secrets into environment"
|
|
|
|
local vault=$(decrypt_vault)
|
|
|
|
if command -v jq &> /dev/null; then
|
|
echo "$vault" | jq -r 'to_entries[] | "export \(.key)=\"\(.value)\""'
|
|
else
|
|
print_error "jq required for shell export"
|
|
exit 1
|
|
fi
|
|
}
|
|
|
|
vault_export() {
|
|
local dest="${1:-.}"
|
|
|
|
if [[ -z "$dest" ]]; then
|
|
print_error "Usage: vault export <filename>"
|
|
exit 1
|
|
fi
|
|
|
|
if [[ -f "$dest" ]]; then
|
|
print_error "File already exists: $dest"
|
|
exit 1
|
|
fi
|
|
|
|
cp "$VAULT_FILE" "$dest"
|
|
chmod 600 "$dest"
|
|
print_success "Vault exported to: $dest"
|
|
}
|
|
|
|
vault_import() {
|
|
local src="${1:-}"
|
|
|
|
if [[ -z "$src" ]]; then
|
|
print_error "Usage: vault import <filename>"
|
|
exit 1
|
|
fi
|
|
|
|
if [[ ! -f "$src" ]]; then
|
|
print_error "File not found: $src"
|
|
exit 1
|
|
fi
|
|
|
|
cp "$src" "$VAULT_FILE"
|
|
chmod 600 "$VAULT_FILE"
|
|
print_success "Vault imported from: $src"
|
|
}
|
|
|
|
vault_status() {
|
|
print_section "Vault Status"
|
|
|
|
if [[ ! -d "$VAULT_DIR" ]]; then
|
|
echo -e " ${YELLOW}⚠${NC} Vault not initialized"
|
|
return
|
|
fi
|
|
|
|
if [[ ! -f "$VAULT_FILE" ]]; then
|
|
echo -e " ${YELLOW}⚠${NC} Vault file not found"
|
|
return
|
|
fi
|
|
|
|
local size=$(du -h "$VAULT_FILE" | cut -f1)
|
|
local modified=$(stat -c %y "$VAULT_FILE" 2>/dev/null | cut -d' ' -f1 || stat -f '%Sm' "$VAULT_FILE" 2>/dev/null)
|
|
|
|
echo -e " ${CYAN}Location:${NC} $VAULT_FILE"
|
|
echo -e " ${CYAN}Size:${NC} $size"
|
|
echo -e " ${CYAN}Modified:${NC} $modified"
|
|
echo -e " ${CYAN}Encryption:${NC} $(get_cipher)"
|
|
echo -e " ${CYAN}Permissions:${NC} $(stat -c '%a' $VAULT_FILE 2>/dev/null || stat -f '%a' "$VAULT_FILE")"
|
|
|
|
echo ""
|
|
}
|
|
|
|
# ============================================================================
|
|
# Main
|
|
# ============================================================================
|
|
|
|
main() {
|
|
print_header
|
|
|
|
# Initialize vault if not exists
|
|
if [[ ! -d "$VAULT_DIR" ]]; then
|
|
init_vault
|
|
fi
|
|
|
|
case "${1:-list}" in
|
|
init)
|
|
init_vault
|
|
;;
|
|
set)
|
|
vault_set "$2" "${3:-}"
|
|
;;
|
|
get)
|
|
vault_get "$2"
|
|
;;
|
|
list|ls)
|
|
vault_list
|
|
;;
|
|
delete|rm)
|
|
vault_delete "$2"
|
|
;;
|
|
shell)
|
|
vault_shell
|
|
;;
|
|
export)
|
|
vault_export "$2"
|
|
;;
|
|
import)
|
|
vault_import "$2"
|
|
;;
|
|
status)
|
|
vault_status
|
|
;;
|
|
*)
|
|
echo "Usage: $0 {init|set|get|list|delete|shell|export|import|status}"
|
|
echo ""
|
|
echo "Commands:"
|
|
echo " init Initialize vault"
|
|
echo " set <key> [value] Store secret (prompts if value omitted)"
|
|
echo " get <key> Retrieve secret"
|
|
echo " list List all keys"
|
|
echo " delete <key> Delete secret"
|
|
echo " shell Print secrets as export statements"
|
|
echo " export <file> Backup vault (encrypted)"
|
|
echo " import <file> Restore vault from backup"
|
|
echo " status Show vault information"
|
|
exit 1
|
|
;;
|
|
esac
|
|
}
|
|
|
|
main "$@"
|