From 2657388998eb7da938c2bce22183a4349fb45cf7 Mon Sep 17 00:00:00 2001 From: Alexandre Pires Date: Sat, 22 Mar 2025 13:06:35 +0100 Subject: [PATCH] Refactor sectool usage in workflows to include configuration file and remove redundant sectool.json files --- .../workflows/ansible-apply-hosts-changes.yml | 20 +++++++++---------- .github/workflows/ansible-apply-playbook.yml | 2 +- .../ansible-validate-playbook-on-pr.yml | 2 +- .github/workflows/terraform-aws-iac-apply.yml | 4 ++-- .../terraform-aws-iac-validate-on-pr.yml | 8 ++++---- .github/workflows/terraform-iac-apply.yml | 4 ++-- .../terraform-iac-validate-on-pr.yml | 8 ++++---- .../workflows/terraform-microk8s-apply.yml | 4 ++-- .../workflows/terraform-microk8s-validate.yml | 8 ++++---- ansible/sectool.json | 7 ------- sectool.json | 3 ++- terraform/iac/sectool.json | 7 ------- terraform/k8sapps/sectool.json | 7 ------- 13 files changed, 32 insertions(+), 52 deletions(-) delete mode 100644 ansible/sectool.json delete mode 100644 terraform/iac/sectool.json delete mode 100644 terraform/k8sapps/sectool.json diff --git a/.github/workflows/ansible-apply-hosts-changes.yml b/.github/workflows/ansible-apply-hosts-changes.yml index 8af350d..c54d801 100644 --- a/.github/workflows/ansible-apply-hosts-changes.yml +++ b/.github/workflows/ansible-apply-hosts-changes.yml @@ -38,13 +38,13 @@ jobs: CHANGED_FILES: ${{ steps.setup_env.outputs.CHANGED_FILES }} run: | cd ansible - sectool exec ansible-playbook -u $ANSIBLE_USER playbook_login.yml - sectool exec ansible-playbook -u $ANSIBLE_USER playbook_cis.yml --skip-tags roles::cis::suid - sectool exec ansible-playbook -u $ANSIBLE_USER playbook_encryption.yml - sectool exec ansible-playbook -u $ANSIBLE_USER playbook_microk8s.yml - sectool exec ansible-playbook -u $ANSIBLE_USER playbook_gitea.yml - sectool exec ansible-playbook -u $ANSIBLE_USER playbook_nextcloud.yml - sectool exec ansible-playbook -u $ANSIBLE_USER playbook_wordpress.yml - sectool exec ansible-playbook -u $ANSIBLE_USER playbook_m3uproxy.yml - sectool exec ansible-playbook -u $ANSIBLE_USER playbook_monitoring.yml - sectool exec ansible-playbook -u $ANSIBLE_USER playbook_rustdesk.yml + sectool -f ../sectool.json exec ansible-playbook -u $ANSIBLE_USER playbook_login.yml + sectool -f ../sectool.json exec ansible-playbook -u $ANSIBLE_USER playbook_cis.yml --skip-tags roles::cis::suid + sectool -f ../sectool.json exec ansible-playbook -u $ANSIBLE_USER playbook_encryption.yml + sectool -f ../sectool.json exec ansible-playbook -u $ANSIBLE_USER playbook_microk8s.yml + sectool -f ../sectool.json exec ansible-playbook -u $ANSIBLE_USER playbook_gitea.yml + sectool -f ../sectool.json exec ansible-playbook -u $ANSIBLE_USER playbook_nextcloud.yml + sectool -f ../sectool.json exec ansible-playbook -u $ANSIBLE_USER playbook_wordpress.yml + sectool -f ../sectool.json exec ansible-playbook -u $ANSIBLE_USER playbook_m3uproxy.yml + sectool -f ../sectool.json exec ansible-playbook -u $ANSIBLE_USER playbook_monitoring.yml + sectool -f ../sectool.json exec ansible-playbook -u $ANSIBLE_USER playbook_rustdesk.yml diff --git a/.github/workflows/ansible-apply-playbook.yml b/.github/workflows/ansible-apply-playbook.yml index 6d1a73b..b4f461b 100644 --- a/.github/workflows/ansible-apply-playbook.yml +++ b/.github/workflows/ansible-apply-playbook.yml @@ -39,5 +39,5 @@ jobs: run: | cd ansible for PLAYBOOK in $(echo $CHANGED_FILES | grep -oP 'playbook_\K\w+'); do - sectool exec ansible-playbook -u $ANSIBLE_USER playbook_$PLAYBOOK.yml + sectool -f ../sectool.json exec ansible-playbook -u $ANSIBLE_USER playbook_$PLAYBOOK.yml done diff --git a/.github/workflows/ansible-validate-playbook-on-pr.yml b/.github/workflows/ansible-validate-playbook-on-pr.yml index bc82a40..250abb6 100644 --- a/.github/workflows/ansible-validate-playbook-on-pr.yml +++ b/.github/workflows/ansible-validate-playbook-on-pr.yml @@ -41,5 +41,5 @@ jobs: run: | cd ansible for PLAYBOOK in $(echo $CHANGED_FILES | grep -oP 'playbook_\K\w+'); do - sectool exec ansible-playbook -u $ANSIBLE_USER playbook_$PLAYBOOK.yml -CD + sectool -f ../sectool.json exec ansible-playbook -u $ANSIBLE_USER playbook_$PLAYBOOK.yml -CD done diff --git a/.github/workflows/terraform-aws-iac-apply.yml b/.github/workflows/terraform-aws-iac-apply.yml index e3926d1..b275342 100644 --- a/.github/workflows/terraform-aws-iac-apply.yml +++ b/.github/workflows/terraform-aws-iac-apply.yml @@ -31,5 +31,5 @@ jobs: BW_ACCESS_TOKEN: ${{ secrets.BW_ACCESS_TOKEN }} run: | cd terraform/aws-iac - sectool exec terraform init - sectool exec terraform apply --auto-approve + sectool -f ../../sectool.json exec terraform init + sectool -f ../../sectool.json exec terraform apply --auto-approve diff --git a/.github/workflows/terraform-aws-iac-validate-on-pr.yml b/.github/workflows/terraform-aws-iac-validate-on-pr.yml index 41093b1..45dc685 100644 --- a/.github/workflows/terraform-aws-iac-validate-on-pr.yml +++ b/.github/workflows/terraform-aws-iac-validate-on-pr.yml @@ -33,7 +33,7 @@ jobs: BW_ACCESS_TOKEN: ${{ secrets.BW_ACCESS_TOKEN }} run: | cd terraform/aws-iac - sectool exec terraform init - sectool exec terraform validate - sectool exec terraform fmt -check - sectool exec terraform plan + sectool -f ../../sectool.json exec terraform init + sectool -f ../../sectool.json exec terraform validate + sectool -f ../../sectool.json exec terraform fmt -check + sectool -f ../../sectool.json exec terraform plan diff --git a/.github/workflows/terraform-iac-apply.yml b/.github/workflows/terraform-iac-apply.yml index 0dc9a0f..6d9d309 100644 --- a/.github/workflows/terraform-iac-apply.yml +++ b/.github/workflows/terraform-iac-apply.yml @@ -52,5 +52,5 @@ jobs: run: | cd terraform/iac export TF_VAR_system_id=$SYSTEM_ID - sectool exec terraform init - sectool exec terraform apply --auto-approve + sectool -f ../../sectool.json exec terraform init + sectool -f ../../sectool.json exec terraform apply --auto-approve diff --git a/.github/workflows/terraform-iac-validate-on-pr.yml b/.github/workflows/terraform-iac-validate-on-pr.yml index dfc9e7d..fbf5c9f 100644 --- a/.github/workflows/terraform-iac-validate-on-pr.yml +++ b/.github/workflows/terraform-iac-validate-on-pr.yml @@ -54,7 +54,7 @@ jobs: run: | cd terraform/iac export TF_VAR_system_id=$SYSTEM_ID - sectool exec terraform init - sectool exec terraform validate - sectool exec terraform fmt -check - sectool exec terraform plan + sectool -f ../../sectool.json exec terraform init + sectool -f ../../sectool.json exec terraform validate + sectool -f ../../sectool.json exec terraform fmt -check + sectool -f ../../sectool.json exec terraform plan diff --git a/.github/workflows/terraform-microk8s-apply.yml b/.github/workflows/terraform-microk8s-apply.yml index e03f32b..c9ab8bf 100644 --- a/.github/workflows/terraform-microk8s-apply.yml +++ b/.github/workflows/terraform-microk8s-apply.yml @@ -51,5 +51,5 @@ jobs: SSH_AUTH_SOCK: ${{ steps.setup_ansible_env.outputs.ssh-auth-sock }} run: | cd terraform/k8sapps - sectool exec terraform init - sectool exec terraform apply --auto-approve + sectool -f ../../sectool.json exec terraform init + sectool -f ../../sectool.json exec terraform apply --auto-approve diff --git a/.github/workflows/terraform-microk8s-validate.yml b/.github/workflows/terraform-microk8s-validate.yml index 4b0c079..5f4b4e8 100644 --- a/.github/workflows/terraform-microk8s-validate.yml +++ b/.github/workflows/terraform-microk8s-validate.yml @@ -51,7 +51,7 @@ jobs: BW_ACCESS_TOKEN: ${{ secrets.BW_ACCESS_TOKEN }} run: | cd terraform/k8sapps - sectool exec terraform init - sectool exec terraform validate - sectool exec terraform fmt -check - sectool exec terraform plan + sectool -f ../../sectool.json exec terraform init + sectool -f ../../sectool.json exec terraform validate + sectool -f ../../sectool.json exec terraform fmt -check + sectool -f ../../sectool.json exec terraform plan diff --git a/ansible/sectool.json b/ansible/sectool.json deleted file mode 100644 index 6618a28..0000000 --- a/ansible/sectool.json +++ /dev/null @@ -1,7 +0,0 @@ -{ - "provider": "bitwarden", - "bitwarden": { - "api_url": "https://api.bitwarden.eu", - "identity_url": "https://identity.bitwarden.eu" - } -} \ No newline at end of file diff --git a/sectool.json b/sectool.json index 6618a28..b50832d 100644 --- a/sectool.json +++ b/sectool.json @@ -2,6 +2,7 @@ "provider": "bitwarden", "bitwarden": { "api_url": "https://api.bitwarden.eu", - "identity_url": "https://identity.bitwarden.eu" + "identity_url": "https://identity.bitwarden.eu", + "project": "c6bd56a4-9fec-4388-b74a-b2a100c0ae07" } } \ No newline at end of file diff --git a/terraform/iac/sectool.json b/terraform/iac/sectool.json deleted file mode 100644 index 6618a28..0000000 --- a/terraform/iac/sectool.json +++ /dev/null @@ -1,7 +0,0 @@ -{ - "provider": "bitwarden", - "bitwarden": { - "api_url": "https://api.bitwarden.eu", - "identity_url": "https://identity.bitwarden.eu" - } -} \ No newline at end of file diff --git a/terraform/k8sapps/sectool.json b/terraform/k8sapps/sectool.json deleted file mode 100644 index 6618a28..0000000 --- a/terraform/k8sapps/sectool.json +++ /dev/null @@ -1,7 +0,0 @@ -{ - "provider": "bitwarden", - "bitwarden": { - "api_url": "https://api.bitwarden.eu", - "identity_url": "https://identity.bitwarden.eu" - } -} \ No newline at end of file