ansible-vault-merge

#!/bin/bash

# Based on https://victorkoronen.se/2017/07/07/merging-ansible-vaults-in-git/

set -e

function debug {
    local var

    if [ ! -v DEBUG ]; then
        return
    fi

    var="${1}"

    eval "echo \"=== $var: \$$var ===\""
    eval "pr -T  -o 4 < \"\${$var}\""
}

ANCESTOR=$1
CURRENT=$2
OTHER=$3

ANCESTOR_DEC=$(mktemp tmp.XXXXXXXXXX)
CURRENT_DEC=$(mktemp tmp.XXXXXXXXXX)
OTHER_DEC=$(mktemp tmp.XXXXXXXXXX)

delete_decrypted_files() {
    debug CURRENT_DEC

    ansible-vault encrypt --output "$CURRENT" "$CURRENT_DEC" || {
        echo "Failed to encrypt ${CURRENT}!" >&2
    }
    rm -f "$ANCESTOR_DEC" "$OTHER_DEC" "$CURRENT_DEC"

    debug CURRENT
}
trap delete_decrypted_files EXIT

ansible-vault decrypt --output "$ANCESTOR_DEC" "$ANCESTOR"
ansible-vault decrypt --output "$OTHER_DEC" "$OTHER"
ansible-vault decrypt --output "$CURRENT_DEC" "$CURRENT"

git merge-file "$CURRENT_DEC" "$ANCESTOR_DEC" "$OTHER_DEC"