homelab-instance-ansible-bastion

Jumphost for Ansible to access Tailnet devices

Managing secrets

Sensitive configuration can be {en,de}crypted using a Vault instance.

Decryption:

vault write transit/decrypt/tf-encryption-key -format=json ciphertext=$(cat backend-config.enc) | jq -r .data.plaintext | base64 -d > backend-config

Encryption:

vault write transit/encrypt/tf-encryption-key -format=json plaintext=$(cat backend-config | base64 -w 0) | jq -r .data.ciphertext > backend-config.enc