$ ansible-vault create|edit|view FILE # work on vault content without leaving copies
$ ansible-vault encrypt FILE / decrypt FILE # in place
$ ansible-vault encrypt_string 'value' --name 'db_password'
$ ansible-vault rekey FILE # change the vault password
$ head -1 FILE # $ANSIBLE_VAULT;1.1;AES256 when encrypted
$ ansible-playbook site.yml --vault-password-file PATH
$ ANSIBLE_VAULT_PASSWORD_FILE=PATH ansible-playbook site.yml
$ sudo install -o deploy -g deploy -m 0400 SRC DST # copy with owner and mode in one step
$ sudo -u deploy env HOME=/var/lib/deploy CMD # test as the service account
$ systemctl show UNIT -p InvocationID --value
$ journalctl -u UNIT _SYSTEMD_INVOCATION_ID=ID -o cat # one run's output
$ sudo grep -rl -- "$SECRET" DIR; echo $? # 1 = no file contains it
# ansible.cfg
[defaults]
vault_password_file = /var/lib/deploy/.vault-password # not ask_vault_pass in automation
- name: Task that handles a secret
ansible.builtin.template: {src: db.conf.j2, dest: /srv/app/config/db.conf, mode: "0640"}
no_log: true