ops(ansible): configure local vault password file

Add an ignored example-backed password file for non-interactive deployments and document the external password file override.

.gitignore

@@ -3,19 +3,27 @@
 .idea/
 .zed/
 
+
 .DS_Store
 .env
+
+# Terraform state files
 *.tfstate
 *.tfstate.*
 *.tfplan
 .terraform/
 infra/terraform.tfvars
 infra/**/*.tfvars
+
+# Ansible specific
 ansible/inventory/hosts.yml
 ansible/inventory/group_vars/all/main.yml
 ansible/inventory/group_vars/all/vault.yml
 ansible/inventory/group_vars/prod/vault.yml
 ansible/inventory/group_vars/staging/vault.yml
+ansible/.vault_pass.txt
+
+# App build output
 app/bin/
 app/tailwindcss
 

README.md

@@ -363,10 +363,22 @@ cd ansible
 ansible-playbook -i inventory/hosts.yml playbooks/setup-node.yml --ask-vault-pass
 ```
 
-The Make deployment target loads `ansible/ansible.cfg` by changing into that directory and regenerates inventory before deployment. Configure `ANSIBLE_VAULT_PASSWORD_FILE` so both playbooks can unlock the Vault files non-interactively:
+For non-interactive deployments, Ansible needs a file containing the password used to encrypt all three Vault files. The project configuration defaults to `ansible/.vault_pass.txt`; create it from the example, replace the placeholder with the Vault password, and restrict its permissions:
+
+```sh
+cp ansible/.vault_pass.txt.example ansible/.vault_pass.txt
+chmod 600 ansible/.vault_pass.txt
+```
+
+`ansible/.vault_pass.txt` is ignored by Git and must never be committed. All three Vault files must use the password stored in this file. To keep the password outside the repository instead, set `ANSIBLE_VAULT_PASSWORD_FILE`:
 
 ```sh
 export ANSIBLE_VAULT_PASSWORD_FILE="$HOME/.config/ansible/todo-vault-password"
+```
+
+The Make deployment target loads `ansible/ansible.cfg`, regenerates inventory, and unlocks the Vault files non-interactively:
+
+```sh
 make deploy-ansible
 ```
 

ansible/.vault_pass.txt.example

@@ -0,0 +1 @@
+your-vault-password

ansible/ansible.cfg

@@ -4,6 +4,7 @@ roles_path = roles
 interpreter_python = auto_silent
 host_key_checking = True
 retry_files_enabled = False
+vault_password_file = .vault_pass.txt
 
 [ssh_connection]
 ssh_args = -o StrictHostKeyChecking=accept-new