Vault / secrets

Ansible has a good way of storing passwords / secrets and still keeping your source code in Git. The tool is called ansible-vault and can be used to encrypt/decrypt secrets.

Creating a secret file

This is for demonstration purposes only. Use/edit our vault in case you need secrets.

Let’s say we have this Yaml file secret.yml containing a password which we want to use in our playbooks:

---
install_password: 'superPassword'

Use this command to encrypt the secret:

ansible-vault encrypt secret.yml 
New Vault password: 
Confirm New Vault password: 
Encryption successful

After this command it’s safe to share / upload it to a repository. Save the password in a password manager and you’re done.

Decrypting / viewing secrets

To view the secrets in the vault file, use the following command:

ansible-vault view <<secret file>>
Vault password:

To decrypt it (Never upload it when you have it decrypted!):

ansible-vault decrypt <<secret file>>
Vault password: 
Decryption successful

Automatically unlocking vault

1. Command line

To prevent having to type a password every time you want to see secrets, execute the following steps:

Write your password to a file ~/.ansible/vault for example.
Set the proper permissions (600)
```
chmod 600 ~/.ansible/vault
```

Set the following environment variable in your .bashrc

export ANSIBLE_VAULT_PASSWORD_FILE=~/.ansible/vault

Now you can automatically unlock the vault without having the password prompt.

2. In Ansible playbooks / roles (system wide)

Write the password to a file /home/ansible-user/.vault for example.
Set the proper permissions (600)
```
chmod 600 /home/ansible-user/.vault
```
In your ansible.cfg (located in /etc/ansible/ansible.cfg) set the following config value:
```
[defaults]
vault_password_file = /home/ansible-user/.vault
```