I've been using a lot of Ansible lately and while almost everything has been great, finding a clean way to implement ansible-vault wasn't immediately apparent.
What I decided on was the following: put your secret information into a vars file, reference that vars file from your task, and encrypt the whole vars file using ansible-vault encrypt.
Let's use an example: You're writing an Ansible role and want to encrypt the spoiler for the movie Aliens.
These are my notes basically. At first i created this gist just as a reminder for myself. But feel free to use this for your project as a starting point. If you have questions you can find me on twitter @thomasf https://twitter.com/thomasf This is how i used it on a Debian Wheezy testing (https://www.debian.org/releases/testing/)
Discuss, ask questions, etc. here https://news.ycombinator.com/item?id=7445545
| events { | |
| worker_connections 1024; | |
| } | |
| http { | |
| default_type text/html; | |
| access_log /dev/stdout; | |
| sendfile on; | |
| keepalive_timeout 65; |
| # FROM: http://forum.parallels.com/showthread.php?290399-Plesk-11-5-Easy-Install-Script-for-Multiple-PHP-CentOS-6-4-x64 | |
| yum -y install gcc make gcc-c++ cpp kernel-headers.x86_64 libxml2-devel openssl-devel bzip2-devel libjpeg-devel libpng-devel freetype-devel openldap-devel postgresql-devel aspell-devel net-snmp-devel libxslt-devel libc-client-devel libicu-devel gmp-devel curl-devel libmcrypt-devel unixODBC-devel pcre-devel sqlite-devel db4-devel enchant-devel libXpm-devel mysql-devel readline-devel libedit-devel recode-devel libtidy-devel | |
| phpconfigureflagscommon="--with-libdir=lib64 --cache-file=./config.cache --prefix=/usr/local/php-\$phpversion-\$phptype --with-config-file-path=/usr/local/php-\$phpversion-\$phptype/etc --disable-debug --with-pic --disable-rpath --with-bz2 --with-curl --with-freetype-dir=/usr/local/php-\$phpversion-\$phptype --with-png-dir=/usr/local/php-\$phpversion-\$phptype --enable-gd-native-ttf --without-gdbm --with-gettext --with-gmp --with-iconv --with-jpeg-dir=/usr/local/php-\$ph |
| # Changing iTerm2 color in MacOSX when SSHing (so you know at a glance that you're no longer in Kansas) | |
| # Adapted from https://gist.github.com/porras/5856906 | |
| # 1. Create a theme in your terminal setting with the name "SSH" and the desired colors, background, etc. | |
| # 2. Add this to your .bash_profile (or .bashrc, I always forget the difference ;)) | |
| # 3. Optional but useful: in the terminal, go to Settings > Startup and set "New tabs open with" to | |
| # "default settings" (otherwise, if you open a new tab from the changed one, you get a local tab with | |
| # the SSH colors) | |
| function tabc() { | |
| NAME=$1; if [ -z "$NAME" ]; then NAME="Default"; fi # if you have trouble with this, change |
| #301 Redirects for .htaccess | |
| #Redirect a single page: | |
| Redirect 301 /pagename.php http://www.domain.com/pagename.html | |
| #Redirect an entire site: | |
| Redirect 301 / http://www.domain.com/ | |
| #Redirect an entire site to a sub folder | |
| Redirect 301 / http://www.domain.com/subfolder/ |
| @echo off | |
| rem | |
| rem **************************************************************************** | |
| rem | |
| rem Copyright (c) Microsoft Corporation. All rights reserved. | |
| rem This code is licensed under the Microsoft Public License. | |
| rem THIS CODE IS PROVIDED *AS IS* WITHOUT WARRANTY OF | |
| rem ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING ANY | |
| rem IMPLIED WARRANTIES OF FITNESS FOR A PARTICULAR | |
| rem PURPOSE, MERCHANTABILITY, OR NON-INFRINGEMENT. |
| #!/bin/sh | |
| # | |
| # Script to prepare and restore full and incremental backups created with innobackupex-runner. | |
| # | |
| # This script is provided as-is; no liability can be accepted for use. | |
| # | |
| INNOBACKUPEX=innobackupex-1.5.1 | |
| INNOBACKUPEXFULL=/usr/bin/$INNOBACKUPEX | |
| TMPFILE="/tmp/innobackupex-restore.$$.tmp" |