KEY="auth/ansible-mgmt.key"
make

VAULTID=""

if [ ! -z $VAULTFILE ]; then
  VAULTID="--vault-password-file=$VAULTFILE"
fi

source .ansible/bin/activate

grep -q "BEGIN OPENSSH PRIVATE KEY" $KEY

if [ "$?" -eq "0"  ]; then
  echo "auth/ansible.key is unencrypted. Ready to run playbooks"
else
  echo "auth/ansible.key needs to be decrypted to run playbooks. Running ansible-vault."
  ansible-vault decrypt $VAULTID $KEY
fi

# vim:ft=sh

# This is the file that will be used to run vault. If it is not set, vault
# will prompt for a password. It is controlled in this manner due to the
# syntax that an assignement string as an argument.
VAULTID=""

# Look for the export of
if [ ! -z $VAULTFILE ]; then
  echo "Using $VAULTFILE for vault commands"
  VAULTID="--vault-password-file=$VAULTFILE"
else
  echo "\$VAULTFILE not set- will prompt for vault password"
fi

# These files should never be committed unencrypted
files=(auth/ansible-mgmt.key roles/docker/wiki/vars/main.yml roles/docker/pihole/vars/main.yml)

for file in ${files[@]}
do
    # Check to see if the file has the vault header
    grep -q "ANSIBLE_VAULT" $file

    if [ "$?" -eq "1"  ]; then
      echo "$file is unencrypted. It needs to be encrypted before you're done."
      ansible-vault encrypt $VAULTID $file
    else
      echo "$file is encrypted."
    fi
done

# Get out of the virtualenv
deactivate

# Disable the zsh "no matches found" option. We will have to now redirect
# STDERR for the 'ls' comannd
setopt +o nomatch

# Cleanup stray 'retry' files from runs that have partially failed
for i in $(ls plays/*.retry 2>/dev/null)
do
  echo -n "Removing $i... "
  rm -rf $i
  echo "Done."
done

# Re-enable nomatch
setopt -o nomatch
# vim:ft=sh