---
- name: reencrypt vault key
  hosts: 127.0.0.1
  tasks:
      - name: check if moreutils is installed
        pacman: name=moreutils state=present

      - name: reencrypt vault key
        shell: set -o pipefail && gpg --decrypt --batch --quiet "{{ playbook_dir }}/../../misc/vault-password.gpg" | gpg --batch --armor --encrypt --output - {% for userid in root_gpgkeys %}--recipient {{ userid }} {% endfor %} | sponge "{{ playbook_dir }}/../../misc/vault-password.gpg"
        changed_when: false
