golden hour

/opt/saltstack/salt/lib/python3.10/site-packages/salt/renderers/__pycache__

File/Folder	Size	Actions
__init__.cpython-310.pyc	201 B
aws_kms.cpython-310.pyc	7.67 KB
cheetah.cpython-310.pyc	754 B
dson.cpython-310.pyc	1.21 KB
genshi.cpython-310.pyc	1.25 KB
gpg.cpython-310.pyc	15.2 KB
hjson.cpython-310.pyc	821 B
jinja.cpython-310.pyc	2.09 KB
json.cpython-310.pyc	711 B
json5.cpython-310.pyc	1.18 KB
mako.cpython-310.pyc	1.05 KB
msgpack.cpython-310.pyc	974 B
nacl.cpython-310.pyc	2.65 KB
pass.cpython-310.pyc	4.59 KB
py.cpython-310.pyc	4.67 KB
pydsl.cpython-310.pyc	13.01 KB
pyobjects.cpython-310.pyc	14.09 KB
stateconf.cpython-310.pyc	12.6 KB
tomlmod.cpython-310.pyc	1.12 KB
wempy.cpython-310.pyc	887 B
yaml.cpython-310.pyc	2.9 KB
yamlex.cpython-310.pyc	927 B

Edit: nacl.cpython-310.pyc

�����xeH
����������������������@���sH���d�Z�ddlZddlZddlZddlZe�e�ZdZ	dd��Z
d
dd	�ZdS�)au��
Renderer that will decrypt NACL ciphers

Any key in the SLS file can be an NACL cipher, and this renderer will decrypt it
before passing it off to Salt. This allows you to safely store secrets in
source control, in such a way that only your Salt master can decrypt them and
distribute them only to the minions that need them.

The typical use-case would be to use ciphers in your pillar data, and keep a
secret key on your master. You can put the public key in source control so that
developers can add new secrets quickly and easily.

This renderer requires the libsodium library binary and PyNacl >= 1.0

Setup
-----

To set things up, first generate a keypair. On the master, run the following:

.. code-block:: bash

# salt-call --local nacl.keygen sk_file=/root/.nacl

Using encrypted pillar
----------------------

To encrypt secrets, copy the public key to your local machine and run:

.. code-block:: bash

$ salt-call --local nacl.enc datatoenc pk_file=/root/.nacl.pub

To apply the renderer on a file-by-file basis add the following line to the
top of any pillar with nacl encrypted data in it:

.. code-block:: yaml

#!yaml|nacl

Now with your renderer configured, you can include your ciphers in your pillar
data like so:

.. code-block:: yaml

#!yaml|nacl

a-secret: "NACL[MRN3cc+fmdxyQbz6WMF+jq1hKdU5X5BBI7OjK+atvHo1ll+w1gZ7XyWtZVfq9gK9rQaMfkDxmidJKwE0Mw==]"
�����Nz^NACL\[(.*)\]$c�����������������K���s����t�jj�|��rt|����fi�|��S�t|�t�r1t�	t
|��dur/td�t�	t
|���d�fi�|��S�|�S�t|�t
�rK|����D�]\}}t|fi�|��|�|<�q:|�S�t|�t�ret|��D�]\}}t|fi�|��|�|<�qT|�S�|�S�)z�
    Recursively try to decrypt any object. If the object is a str, and it
    contains a valid NACLENC pretext, decrypt it, otherwise keep going until a
    string is found.
    Nznacl.dec����)�salt�utilsZstringioZis_readable�_decrypt_object�getvalue�
isinstance�str�re�search�
NACL_REGEXZ__salt__�group�dict�items�list�	enumerate)�obj�kwargs�key�value��r����G/opt/saltstack/salt/lib/python3.10/site-packages/salt/renderers/nacl.pyr���@���s���
"

r����base��c�����������������K���s���t�|�fi�|��S�)za
    Decrypt the data to be rendered using the given nacl key or the one given
    in config
    )r���)Z	nacl_dataZsaltenvZslsZargliner���r���r���r����renderY���s���r���)r���r���r���)�__doc__Zloggingr	���Z
salt.syspathsr���Zsalt.utils.stringioZ	getLogger�__name__�logr���r���r���r���r���r���r����<module>���s����5