Repository navigation
Add trellis vault generate command - #749
Open
swalkinshaw wants to merge 1 commit into
Open
swalkinshaw wants to merge 1 commit into
swalkinshaw wants to merge 1 commit into
Conversation
Generates passwords and WordPress keys/salts in group_vars/<env>/vault.yml for projects that weren't created with `trellis new` (e.g. cloned from a template repo). Fixes #426. Only missing, empty, or placeholder values ("generateme" and the example passwords in Trellis' default vaults) are generated, so it's idempotent. Comments and other values are preserved via yamledit, and Jinja templated values are never replaced. Encrypted vaults are decrypted and re-encrypted by piping through ansible-vault so plaintext never touches disk. --force regenerate all secrets (requires ENVIRONMENT) --salts-only only the WordPress keys and salts `trellis new` now uses the same code (with force) to update the downloaded vault.yml files in place instead of overwriting them, keeping Trellis' comments. It also no longer adds `admin_password` to non-development vaults since it's only used by the wordpress-install role in development. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes #426
Adds
trellis vault generateto fill in passwords and WordPress keys/salts ingroup_vars/<env>/vault.yml. It's for projects that weren't created withtrellis new, such as ones cloned from a template repo.generatemeand the example values in Trellis's default vaults (devpw,example_dbpassword, ...). Running it again reports "No secrets to generate".{{ ... }}), even with--forcewordpress_sites.yml, so multisite projects workyamleditansible-vault decrypt --output -and re-encrypted by piping toansible-vault encrypt --output <file>, so the plaintext is never written to disk--forceregenerates values that are already set and requires an ENVIRONMENT argument, so production database or user passwords can't be rotated by accident.--force --salts-only productionis a safe way to rotate salts.trellis newnewnow uses the same code with force enabled to update the downloadedvault.ymlfiles in place instead of overwriting them, so Trellis's comments stay.GenerateVaultConfig, theVaultstructs, andWriteYamlFileare removed because nothing uses them any more.Behaviour change:
admin_passwordis now generated only fordevelopment. It's only used by thewordpress-installrole, which runs only in development, and upstream's staging and production vaults don't include it.Testing
--force,--salts-only, templated values, multiple sites, idempotency, andnew's vault updateansible-vault) and a decryption failureansible-vault-encrypted production vault: 11 placeholders filled, an existing realdb_passwordkept, comments preserved, the file still encrypted afterwards, and a second run generated nothing🤖 Generated with Claude Code