DEV Community: David Ngugi

Resolve merge conflicts in ansible vault

David Ngugi — Thu, 10 Apr 2025 13:22:38 +0000

When you use ansible vault in your project, sometimes merge conflicts would occur across divergent branches that make changes to the encrypted file. Below is a simple process to identify and resolve merge conflicts introduced in an ansible vault file.

Step 1: Decrypt the vault

For each of the divergent branches, decrypt the vault so that you can have a readable text file

git checkout master
git pull
ansible-vault decrypt secrets-file
git commit -am "decrypting vault to better handle merge conflicts"

git checkout my-new-branch
git pull
ansible-vault decrypt secrets-file

Step 2: Start Merge operation

You can now attempt to merge one branch into the other based on your preferred strategy

git merge master
Auto-merging secrets-file
CONFLICT (content): Merge conflict in secrets-file
Automatic merge failed; fix conflicts and then commit the result.

Open your favourite IDE and resolve the merge conflicts presented

Complete the merge

git add secrets-file
git commit -m "Resolved merge conflicts"

Step 3: Clean up

Now that you have resolved your merge conflicts locally, encrypt the update secret file

ansible-vault encrypt secrets-file

And clean up your other branch

git checkout master
git reset --hard origin/master

Encrypt

Step 4: Push to remote(optional)

If done working on your branch, you can push all your merged changes to remote

git checkout my-new-branch
git push

Change default nameserver in Linux

David Ngugi — Thu, 27 Feb 2025 10:11:43 +0000

My internet provider provides a wifi router that is pre-configured with DHCP that also provides the nameserver as their internal DNS server. There is a ton of info about why you wouldn't want this and they revolve about 2 main issues; security and performance.

Fedora 40

On Fedora, the wifi is managed by Network manager. I chose to use cloud-dns with encryption so that no-one in the middle can see what I am looking up on the internet. I chose cloud-dns because they tend to be more performant than Google nameservers.

Additionally, I also want to persistent these changes to all wifi connections regardless of which wifi network I use which is handy for laptops on the move.

Create a global NetworkManager configuration file

sudo nano /etc/NetworkManager/conf.d/dns-override.conf

Add the following content

[main]
dns=none

This tells NetworkManager not to use DHCP-assigned DNS.

Override DNS for all Wi-Fi connections

sudo nano /etc/NetworkManager/conf.d/dns-servers.conf

Add:

[global-dns]
servers=1.1.1.2,1.0.0.2

Enable DNS Over TLS
Open sudo nano /etc/systemd/resolved.conf and copy the following in

[Resolve]
DNS=1.1.1.2 1.0.0.2
DNSOverTLS=yes

Restart systemd-resolved and NetworkManager

sudo systemctl restart systemd-resolved
sudo systemctl restart NetworkManager

Debian based Linux

Disable DHCP-provided DNS from Wi-Fi Interface
Edit the sudo nano /etc/systemd/network/20-wireless.network configuration for your interface (if applicable):

[Network]
DNS=1.1.1.2 1.0.0.2
DNSOverTLS=yes
Domains=~.

Restart networking services

sudo systemctl restart systemd-networkd

Exporting seahorse keyring to keepassxc

David Ngugi — Tue, 11 Feb 2025 07:02:36 +0000

If you are like me and started putting your passwords into the default keyring application on Linux, then you'd probably want to move them when you switch. The default Seahorse keyring application on Ubuntu doesn't have an export feature. Here are the steps to export out to keepassxc, a modern key manager.

You can download and install keepassxc from here -> https://keepassxc.org/download/#linux

Unlock your Seahorse keyring

Right click on the keyring to export and select "Change password".

Enter the old password and then leave the new passwords empty and select "Continue". Accept any warnings shown.
Now your keyring is decrypted and looks like this:

crazywizard@crazywizard-ThinkPad-X1-Carbon-Gen-9:~/.local/share/keyrings$ cat login.keyring 
[keyring]
display-name=Login
ctime=1695477404
mtime=0
lock-on-idle=false
lock-after=false

[14]
item-type=0
display-name=Mysql@sqlreplica.example.com:3306
secret=mypassword
mtime=1543408141
ctime=1543408141

[14:attribute0]
name=account
type=string
value=crazywizard

[14:attribute1]
name=service
type=string
value=Mysql@sqlreplica.example.com:3306

[14:attribute2]
name=xdg:schema
type=string

Transform/Export contents to csv format

Copy the decrypted keyring to your /tmp directory. In Ubuntu 20.04+ , the keyring is located in the path ~/.local/share/keyrings
Save this Python script and run it, specifying the keyring_file and csv_file to match yours.

import csv
import configparser

# Input and output file paths
keyring_file = "/tmp/login.keyring"  # Replace with your actual keyring file
csv_file = "keyring_export.csv"

# Parse the keyring file with interpolation disabled
config = configparser.ConfigParser(interpolation=None)
config.read(keyring_file)

# Prepare data for CSV
entries = []
for section in config.sections():
    if section.isdigit():  # Key entries are numeric
        display_name = config.get(section, "display-name", fallback="")
        secret = config.get(section, "secret", fallback="")
        username = ""
        service = ""

        # Extract attributes
        for key in config:
            if key.startswith(f"{section}:"):
                attr_name = config.get(key, "name", fallback="")
                attr_value = config.get(key, "value", fallback="")
                if attr_name == "account":
                    username = attr_value
                elif attr_name == "service":
                    service = attr_value

        # Add to the entries list
        entries.append(["Imported", display_name, username, secret, service, "Imported from Seahorse"])

# Write to CSV with proper columns
with open(csv_file, "w", newline="") as f:
    writer = csv.writer(f)
    writer.writerow(["Group", "Title", "Username", "Password", "URL", "Notes"])
    writer.writerows(entries)

print(f"Export complete! File saved as {csv_file}")

Import to keepassxc

Next, import the generated csv file in keepassxc via Database->Import->CSV File. Follow the prompts including setting up a password for your database.

Success!! Your seahorse passwords are now imported on keepassxc.!