fix: add /dev/stdin as sops path_regex

Signed-off-by: Devin Buhl <devin@buhl.casa>

bootstrap/tasks/addons/csi_driver_nfs.yaml

@@ -20,12 +20,8 @@
     mode: "0644"
   with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
 
-# https://github.com/ansible-collections/community.sops/issues/153
 - name: Template encrypted files for {{ addon_namespace }}/{{ addon_name }}
   block:
-    - name: Disable Sops config
-      ansible.builtin.include_tasks:
-        file: ../sops/disable.yaml
     - name: Template encrypted files
       when: item.state == 'file' and 'sops' in item.path
       community.sops.sops_encrypt:
@@ -36,10 +32,3 @@
         mode: "0644"
         force: true
       with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
-    - name: Enable Sops config
-      ansible.builtin.include_tasks:
-        file: ../sops/enable.yaml
-  rescue:
-    - name: Enable Sops config
-      ansible.builtin.include_tasks:
-        file: ../sops/enable.yaml

bootstrap/tasks/addons/discord_template_notifier.yaml

@@ -20,12 +20,8 @@
     mode: "0644"
   with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
 
-# https://github.com/ansible-collections/community.sops/issues/153
 - name: Template encrypted files for {{ addon_namespace }}/{{ addon_name }}
   block:
-    - name: Disable Sops config
-      ansible.builtin.include_tasks:
-        file: ../sops/disable.yaml
     - name: Template encrypted files
       when: item.state == 'file' and 'sops' in item.path
       community.sops.sops_encrypt:
@@ -36,10 +32,3 @@
         mode: "0644"
         force: true
       with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
-    - name: Enable Sops config
-      ansible.builtin.include_tasks:
-        file: ../sops/enable.yaml
-  rescue:
-    - name: Enable Sops config
-      ansible.builtin.include_tasks:
-        file: ../sops/enable.yaml

bootstrap/tasks/addons/grafana.yaml

@@ -20,12 +20,8 @@
     mode: "0644"
   with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
 
-# https://github.com/ansible-collections/community.sops/issues/153
 - name: Template encrypted files for {{ addon_namespace }}/{{ addon_name }}
   block:
-    - name: Disable Sops config
-      ansible.builtin.include_tasks:
-        file: ../sops/disable.yaml
     - name: Template encrypted files
       when: item.state == 'file' and 'sops' in item.path
       community.sops.sops_encrypt:
@@ -36,10 +32,3 @@
         mode: "0644"
         force: true
       with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
-    - name: Enable Sops config
-      ansible.builtin.include_tasks:
-        file: ../sops/enable.yaml
-  rescue:
-    - name: Enable Sops config
-      ansible.builtin.include_tasks:
-        file: ../sops/enable.yaml

bootstrap/tasks/addons/hajimari.yaml

@@ -23,9 +23,6 @@
 # https://github.com/ansible-collections/community.sops/issues/153
 - name: Template encrypted files for {{ addon_namespace }}/{{ addon_name }}
   block:
-    - name: Disable Sops config
-      ansible.builtin.include_tasks:
-        file: ../sops/disable.yaml
     - name: Template encrypted files
       when: item.state == 'file' and 'sops' in item.path
       community.sops.sops_encrypt:
@@ -36,10 +33,3 @@
         mode: "0644"
         force: true
       with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
-    - name: Enable Sops config
-      ansible.builtin.include_tasks:
-        file: ../sops/enable.yaml
-  rescue:
-    - name: Enable Sops config
-      ansible.builtin.include_tasks:
-        file: ../sops/enable.yaml

bootstrap/tasks/addons/kube_prometheus_stack.yaml

@@ -20,12 +20,8 @@
     mode: "0644"
   with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
 
-# https://github.com/ansible-collections/community.sops/issues/153
 - name: Template encrypted files for {{ addon_namespace }}/{{ addon_name }}
   block:
-    - name: Disable Sops config
-      ansible.builtin.include_tasks:
-        file: ../sops/disable.yaml
     - name: Template encrypted files
       when: item.state == 'file' and 'sops' in item.path
       community.sops.sops_encrypt:
@@ -36,10 +32,3 @@
         mode: "0644"
         force: true
       with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
-    - name: Enable Sops config
-      ansible.builtin.include_tasks:
-        file: ../sops/enable.yaml
-  rescue:
-    - name: Enable Sops config
-      ansible.builtin.include_tasks:
-        file: ../sops/enable.yaml

bootstrap/tasks/addons/kubernetes_dashboard.yaml

@@ -20,12 +20,8 @@
     mode: "0644"
   with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
 
-# https://github.com/ansible-collections/community.sops/issues/153
 - name: Template encrypted files for {{ addon_namespace }}/{{ addon_name }}
   block:
-    - name: Disable Sops config
-      ansible.builtin.include_tasks:
-        file: ../sops/disable.yaml
     - name: Template encrypted files
       when: item.state == 'file' and 'sops' in item.path
       community.sops.sops_encrypt:
@@ -36,10 +32,3 @@
         mode: "0644"
         force: true
       with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
-    - name: Enable Sops config
-      ansible.builtin.include_tasks:
-        file: ../sops/enable.yaml
-  rescue:
-    - name: Enable Sops config
-      ansible.builtin.include_tasks:
-        file: ../sops/enable.yaml

bootstrap/tasks/addons/system_upgrade_controller.yaml

@@ -20,12 +20,8 @@
     mode: "0644"
   with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
 
-# https://github.com/ansible-collections/community.sops/issues/153
 - name: Template encrypted files for {{ addon_namespace }}/{{ addon_name }}
   block:
-    - name: Disable Sops config
-      ansible.builtin.include_tasks:
-        file: ../sops/disable.yaml
     - name: Template encrypted files
       when: item.state == 'file' and 'sops' in item.path
       community.sops.sops_encrypt:
@@ -36,10 +32,3 @@
         mode: "0644"
         force: true
       with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
-    - name: Enable Sops config
-      ansible.builtin.include_tasks:
-        file: ../sops/enable.yaml
-  rescue:
-    - name: Enable Sops config
-      ansible.builtin.include_tasks:
-        file: ../sops/enable.yaml

bootstrap/tasks/addons/weave_gitops.yaml

@@ -20,12 +20,8 @@
     mode: "0644"
   with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
 
-# https://github.com/ansible-collections/community.sops/issues/153
 - name: Template encrypted files for {{ addon_namespace }}/{{ addon_name }}
   block:
-    - name: Disable Sops config
-      ansible.builtin.include_tasks:
-        file: ../sops/disable.yaml
     - name: Template encrypted files
       when: item.state == 'file' and 'sops' in item.path
       community.sops.sops_encrypt:
@@ -36,10 +32,3 @@
         mode: "0644"
         force: true
       with_community.general.filetree: ["../templates/addons/{{ addon_name }}/"]
-    - name: Enable Sops config
-      ansible.builtin.include_tasks:
-        file: ../sops/enable.yaml
-  rescue:
-    - name: Enable Sops config
-      ansible.builtin.include_tasks:
-        file: ../sops/enable.yaml

bootstrap/tasks/ansible/main.yaml

@@ -17,9 +17,6 @@
 
 - name: Template Ansible encrypted files
   block:
-    - name: Disable Sops config
-      ansible.builtin.include_tasks:
-        file: ../sops/disable.yaml
     - name: Template Ansible encrypted files
       when: item.state == 'file' and 'sops' in item.path
       community.sops.sops_encrypt:
@@ -40,10 +37,3 @@
       loop: "{{ bootstrap_nodes.master + bootstrap_nodes.worker | default([]) }}"
       loop_control:
         label: "{{ item.address }}"
-    - name: Enable Sops config
-      ansible.builtin.include_tasks:
-        file: ../sops/enable.yaml
-  rescue:
-    - name: Enable Sops config
-      ansible.builtin.include_tasks:
-        file: ../sops/enable.yaml

bootstrap/tasks/kubernetes/main.yaml

@@ -54,9 +54,6 @@
 
 - name: Template Kubernetes encrypted files
   block:
-    - name: Disable Sops config
-      ansible.builtin.include_tasks:
-        file: ../sops/disable.yaml
     - name: Template Kubernetes encrypted files
       when: item.state == 'file' and 'sops' in item.path
       community.sops.sops_encrypt:
@@ -67,10 +64,3 @@
         mode: "0644"
         force: true
       with_community.general.filetree: ["../templates/kubernetes/"]
-    - name: Enable Sops config
-      ansible.builtin.include_tasks:
-        file: ../sops/enable.yaml
-  rescue:
-    - name: Enable Sops config
-      ansible.builtin.include_tasks:
-        file: ../sops/enable.yaml

bootstrap/tasks/sops/disable.yaml

@@ -1,12 +0,0 @@
----
-# https://github.com/ansible-collections/community.sops/issues/153
-- name: Rename Sops configuration file
-  ansible.builtin.copy:
-    src: "{{ repository_path }}/.sops.yaml"
-    dest: "{{ repository_path }}/.sops.yaml.orig"
-    mode: "0644"
-
-- name: Remove Sops configuration file
-  ansible.builtin.file:
-    path: "{{ repository_path }}/.sops.yaml"
-    state: absent

bootstrap/tasks/sops/enable.yaml

@@ -1,12 +0,0 @@
----
-# https://github.com/ansible-collections/community.sops/issues/153
-- name: Restore Sops configuration file
-  ansible.builtin.copy:
-    src: "{{ repository_path }}/.sops.yaml.orig"
-    dest: "{{ repository_path }}/.sops.yaml"
-    mode: "0644"
-
-- name: Remove backed up Sops configuration file
-  ansible.builtin.file:
-    path: "{{ repository_path }}/.sops.yaml.orig"
-    state: absent

bootstrap/templates/.sops.yaml.j2

@@ -9,3 +9,8 @@ creation_rules:
     key_groups:
       - age:
           - "{{ bootstrap_age_public_key }}"
+  # https://github.com/ansible-collections/community.sops/issues/153
+  - path_regex: /dev/stdin
+    key_groups:
+      - age:
+          - "{{ bootstrap_age_public_key }}"