colem/todo-hetzner
1
0
Fork 0
mirror of https://github.com/cole-maxwell1/todo-hetzner.git synced 2026-10-27 19:02:49 -05:00
Code Issues Packages Projects Releases Wiki Activity

ops(ansible): configure local vault password file

Browse Source 
Add an ignored example-backed password file for non-interactive deployments and document the external password file override.
This commit is contained in:
cole-maxwell1
2026-08-07 12:06:39 -05:00
parent eaf53f8256
commit b8f655ac58
4 changed files with 23 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+13 -1
View File
@@ -363,10 +363,22 @@ cd ansible
ansible-playbook -i inventory/hosts.yml playbooks/setup-node.yml --ask-vault-pass
```
The Make deployment target loads `ansible/ansible.cfg` by changing into that directory and regenerates inventory before deployment. Configure `ANSIBLE_VAULT_PASSWORD_FILE` so both playbooks can unlock the Vault files non-interactively:
For non-interactive deployments, Ansible needs a file containing the password used to encrypt all three Vault files. The project configuration defaults to `ansible/.vault_pass.txt`; create it from the example, replace the placeholder with the Vault password, and restrict its permissions:
```sh
cp ansible/.vault_pass.txt.example ansible/.vault_pass.txt
chmod 600 ansible/.vault_pass.txt
```
`ansible/.vault_pass.txt` is ignored by Git and must never be committed. All three Vault files must use the password stored in this file. To keep the password outside the repository instead, set `ANSIBLE_VAULT_PASSWORD_FILE`:
```sh
export ANSIBLE_VAULT_PASSWORD_FILE="$HOME/.config/ansible/todo-vault-password"
```
The Make deployment target loads `ansible/ansible.cfg`, regenerates inventory, and unlocks the Vault files non-interactively:
```sh
make deploy-ansible
```