Retire Ansible Vault (last step, after P7/P8/R) #120
Loading…
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Status 2026-10-13: not started; blocked on #117 (P8), #118 (P7) and #119 (R). Nothing in this list has been touched, and nothing should be until those are Met and the end-to-end check below passes.
Do this last, only after P7, P8 and R are Met. Full checklist:
docs/secrets-management-sops.md, section "Retiring Ansible Vault". Until then every Ansible Vault fallback is the way back.Prerequisites (each must be true before any deletion):
sops-age-recovery-infra), not Keychain: recover key, decrypt, run Ansible against staging.rotate-secret.shproven on the real vault (see the P8 issue).main, CI green, a fresh-clone recovery drill passes.secrets/backup/(see the R issue).Then, in one PR, remove together (removing one config line without its pair breaks startup):
vault_password_fileinansible.cfgandansible-profile.cfg, the dummyANSIBLE_VAULT_PASSWORD_FILEin.forgejo/workflows/lint.yml,packer/ci-runner/ci-runner.pkr.hcl,roles/ci_ephemeral_provisioner/tasks/main.yml(+ its CLAUDE.md),playbooks/rotate-secret.yml(vault_pass_file).setup,scripts/lib/common-vault.sh,scripts/lib/setup/vault.sh,scripts/lib/manage/core.sh,rotate-secret.sh,rotate-ovh-s3-credentials.sh,regenerate-ci-ephemeral-ssh-key.sh,verify-vaultwarden-token.sh,deploy-services.sh,init-vaultwarden.sh.secrets/vault.yml.ansible-vault,secrets/.vault_pass, theansible-vault/infraKeychain item, the Bitwarden ansible-vault password item, the Tier-1 row indocs/secrets-recovery.md.docs/runbooks/vault-lockout.md(legacy) and the remainingansible-vaultmentions.staging-validateand lint after, before deleting the old password from anywhere.Add to the retirement checklist (found 2026-10-14 while sorting migration vs long-term scripts):
scripts/init-vaultwarden.shandscripts/verify-vaultwarden-token.shstill referencesecrets/vault.yml(Ansible Vault era). Decide per script: port tovault-set.py/ the SOPS vault, or delete. Not verified whether either still works.scripts/with-vault.sh: the bridge that decrypts SOPS into thesecrets/vault.ymlfile the playbooksinclude_vars. Stays until the playbooks read SOPS-derived vars directly; remove with the lastvault.ymlconsumer (see the note inscripts/deploy-services.sh).vault.yml:scripts/gen-auth-secrets.sh(still used byinit-secrets.shandgen-staging-secrets.py, so keep the script, fix the header) andscripts/rotate-secret.sh.scripts/check-secret-hygiene.pyforbidssecrets/vault.ymlandsecrets/backup/*; keep those rules after retirement.secrets/backup/(pre-cutover ciphertext): see #119 for the delete-the-password-first decision.