Ansible and taskfile

Usage:

export AVP=XXXX
#
task plan
#
task apply -- --tags nginx --limit srv.loc

File .env

ANSIBLE_ROLES_PATH='../ansible-roles'
ANSIBLE_VAULT_PASSWORD_FILE=./get-avp.sh
INVENTORY=inventory/hosts.yml
PLAYBOOK=playbook/playbook.yml
VAULT_FILE=inventory/vault/data.yml

File taskfile.yml

version: "3"

dotenv: [".env"]

tasks:
  isready_vault:
    preconditions:
      - sh: test -n "${ANSIBLE_VAULT_PASSWORD}" || test -n ${AVP}
        msg: "ERROR: Environment variables ANSIBLE_VAULT_PASSWORD or AVP not defined."

      - sh: test -n "${ANSIBLE_VAULT_PASSWORD_FILE}"
        msg: "ERROR: Environment variable 'ANSIBLE_VAULT_PASSWORD_FILE' not defined."

  isready:
    deps: [isready_vault]

  help:
    desc: Show available tasks
    cmds:
      - task --list

  pull:
    desc: Update this repo and the roles repo
    deps: [pull-self, pull-roles]

  pull-self:
    desc: Git pull for this repository
    cmds:
      - git pull

  pull-roles:
    desc: Git pull for the ansible-roles repository
    dir: "{{ .ANSIBLE_ROLES_PATH }}"
    cmds:
      - git pull

  vars:
    desc: Show all vars
    deps: [isready]
    cmds:
      - ansible-playbook -i {{.INVENTORY}} --limit $(hostname) {{.CLI_ARGS}} playbook/vars.yml

  plan:
    desc: Run the Ansible playbook in check mode
    deps: [isready]
    cmds:
      - ansible-playbook -k -K --check --diff -i {{.INVENTORY}} --limit $(hostname) {{.CLI_ARGS}} {{.PLAYBOOK}}

  apply:
    desc: Run the Ansible playbook
    deps: [isready]
    cmds:
      - ansible-playbook -k -K --diff -i {{.INVENTORY}} --limit $(hostname) {{.CLI_ARGS}} {{.PLAYBOOK}}

  apply-config:
    desc: Run the Ansible playbook
    deps: [isready]
    cmds:
      - ansible-playbook -k -K --diff -i {{.INVENTORY}} --limit $(hostname) {{.PLAYBOOK}} --tags etc-hosts,user-ssh-config

  vault-edit:
    desc: Edit a vault file
    cmds:
      - ansible-vault edit {{.VAULT_FILE}}

  vault-view:
    desc: View contents of a vault file
    cmds:
      - ansible-vault view {{.VAULT_FILE}}

File: ./get-avp.sh

#!/usr/bin/env bash
echo ${ANSIBLE_VAULT_PASSWORD:-$AVP}