From 95f487fa2a8f99f2fead3cf4613993c09740dd97 Mon Sep 17 00:00:00 2001
From: Lukas Stancik <lukas.stancik@gmail.com>
Date: Mon, 17 Mar 2025 17:42:46 +0000
Subject: [PATCH] Simplify vault script

It gathers all .age files and decrypts into secrets folder that is .gitignored. Assembly of the distribution plucks the decrypted files from secrets folder
---
 vault | 32 ++++++++++++++++----------------
 1 file changed, 16 insertions(+), 16 deletions(-)

diff --git a/vault b/vault
index abb071d..67e51e0 100755
--- a/vault
+++ b/vault
@@ -1,38 +1,38 @@
 #!/bin/sh
 set -e
 
-FILES_IN_VAULT='./src/wifi-password.txt
-./src/repository-builder/packager.rsa
-./src/repository-builder/packager.rsa.pub
-./src/wireguard.private.key
-./src/wireguard.public.key
-./src/authorized_keys'
+FILES_IN_VAULT=$(find . -name *.age)
 
 age_encrypt() {
-  local input="$1"
-  local output="$1.tmp"
-  local AGE_PASSPHRASE=`cat ./.vault_password_file`
+  if [ $# -ne 1 ] ; then
+    echo "invalid argument"
+    exit 1
+  fi
 
-  ./cache/age/age --encrypt --passphrase --armor --output $output $input && rm $input && mv $output $input
+  AGE_PASSPHRASE=$(cat ./.vault_password_file) age --encrypt --passphrase --armor --output "$2" "$1"
 }
 
 age_decrypt() {
-  local input="$1"
-  local output="$1.tmp"
-  local AGE_PASSPHRASE=`cat ./.vault_password_file`
+  if [ $# -ne 1 ] ; then
+    echo "invalid argument"
+    exit 1
+  fi
 
-  ./cache/age/age --decrypt --output $output $input && rm $input && mv $output $input
+  BASENAME=$(basename $1 .age)
+
+  AGE_PASSPHRASE=$(cat ./.vault_password_file) age --decrypt --output "secrets/$BASENAME" "$1"
 }
 
+
 encrypt() {
   for FILE in $FILES_IN_VAULT; do
-    age_encrypt $FILE
+    age_encrypt "$FILE"
   done
 }
 
 decrypt() {
   for FILE in $FILES_IN_VAULT; do
-    age_decrypt $FILE
+    age_decrypt "$FILE"
   done
 }