I've been using a lot of Ansible lately and while almost everything has been great, finding a clean way to implement ansible-vault wasn't immediately apparent.
What I decided on was the following: put your secret information into a vars file, reference that vars file from your task, and encrypt the whole vars file using ansible-vault encrypt.
Let's use an example: You're writing an Ansible role and want to encrypt the spoiler for the movie Aliens.
| # This is an example of the Stack Exchange Tier 1 HAProxy config | |
| # The only things that have been changed from what we are running are: | |
| # 1. User names have been removed | |
| # 2. All Passwords have been remove | |
| # 3. IPs have been changed to use the example/documentation ranges | |
| # 4. Rate limit numbers have been changed to randome numbers, don't read into them | |
| userlist stats-auth | |
| group admin users $admin_user | |
| user $admin_user insecure-password $some_password |
# make sure to replace `<hash>` with your gist's hash
git clone https://gist.github.com/<hash>.git # with https
git clone [email protected]:<hash>.git # or with ssh
| // This rule will get the groups for users coming from Azure AD | |
| // Auth0 already has the option to do that, but it (currently) won't work | |
| // if the user is coming from a different directory than the directory | |
| // where the app is registered (this can happen with multi-tenant apps). | |
| // It uses the access_token provided by Azure AD, so this needs | |
| // the 'Open ID Connect' protocol selected in the Azure AD connection. | |
| // | |
| // After the rule runs, you will have the 'groups' property in the user | |
| // that you can use to add custom claims to the id_token. | |
| // |
| async function getTokenFromRulesConfig(user, context, callback) { | |
| const m2mClientID = configuration.m2mCID; | |
| const m2mClientSecret = configuration.m2mCSecret; | |
| let auth0Domain = '<<your_tenant>>.auth0.com'; | |
| const moment = require('moment-timezone'); | |
| let axios = require('axios'); | |
| const country = context.request.geoip.country_name; | |
| const data = { | |
| user_app_metadata: user.app_metadata, | |
| email: user.email, |
| addEventListener('fetch', event => { | |
| event.respondWith(handleRequest(event.request)) | |
| }) | |
| async function handleRequest(request) { | |
| const url = new URL(request.url) | |
| url.hostname = 'SOME_HOSTNAME' // i.e. 'dev-w-47n-vy-cd-e88kLg26GFbLGgBI.edge.tenants.auth0.com' | |
| request = new Request(request) | |
| request.headers.set('cname-api-key', 'SOME_KEY') // i.e. 'd4f2f3ef5a3ee3af4846127281d3450628bdc16d63e802dea75878fe9a63a279' | |