Ansible: gocryptfs doesn't ask for password

Question

When I use Ansible to create all kinds of remote mounts that need a SSH password, the ansible-playbook command simply asks for them when I run it. However, when I want to create a gocryptfs mount, I get

FAILED! => {"changed": false, "msg": "Error mounting /mnt/test: Reading Password from stdin\nGot empty Password from stdin\n"}

Here is my playbook task:

- name: Decrypt
  ansible.posix.mount:
    src: gocryptfs#/mnt/.enc_test
    path: /mnt/test
    state: mounted
    fstype: fuse
    opts: nofail

How do I make sure the password is always asked? I know I can supply the option -extpass, but what program would I use there to get a default terminal prompt when I run the playbook first and create the fstab entry, and an input like dm-crypt on booting?

Answer 1

You can't expect the module mount to respond to the prompts like the module expect does.

There are more options on how to solve this problem. The first and the second option below don't create an entry in /etc/fstab

1. Use the module expect if you want to provide gocryptfs with the password interactively

2. Use the module command and try the parameter stdin or provide gocryptfs with the password in the options:

• -extpass CMD [-extpass ARG1 ...] Use external program ... to return the password on stdout
• -passfile FILE [-passfile FILE2 ...] Read password from the specified plain text file

3. Provide the module mount with the password file. See example

  ansible.posix.mount:
    src: /mnt/.enc_test
    path: /mnt/test
    state: mounted
    fstype: fuse./usr/local/bin/gocryptfs
    opts: nofail,passfile=/tmp/password 

^{(not tested)}

4. If you have problems with the module mount use lineinfile and create the entry in /etc/fstab on your own. Create and notify a handler mount -a.

See: (Re-)starting a systemd unit with user input on Ansible