# Ansible. Securing your secrets.  Noob level.

So. You have you playbook in git and you want to keep some variables invisible to others. You probably should go for a ‘real’ password manager like Hashicorp Vault. Or pass ([https://www.passwordstore.org/](https://www.passwordstore.org/)). Both have ready to use lookup plugins in Ansible. But let’s start with something more… local. The ansible vault.

First, you have to remember your password. Store it in the `.vault_password` file in your home dir. Just remember to make it readable only for you.

```bash
chmod go-rwx ~/.vault_password
```

Now, tell Ansible to use the file. You can do it in ansible.cfg.

```ini
[defaults]
vault_password_file = ~/.vault_password
```

We’re going to keep the secrets and private vars outside our repo. So - we’re going to create a kind of inventory which contain only variables.

```bash
mkdir -p ~/my_ansible_secrets/group_vars/all/
```

Then make ansible using it. We will add the new inventory to a config. Ansible don’t mind having multiple inventories. Now, our ansible.cfg looks like that

```ini
[defaults]
inventory = testinv.yaml, ~/my_ansible_secrets
vault_password_file = ~/.ansible_password
```

Now’s time to encrypt.

```bash
ansible-vault encrypt_string -n my_secret 'i wont tell' >> ~/my_ansible_secrets/group_vars/all/secrets.yaml
```

Please look into the file. Adding minuses at the beginning of an YAML file won’t hurt.

```yaml
---
my_secret: !vault |
          $ANSIBLE_VAULT;1.1;AES256
          66626630323438343166393164343162366634346362386163623036613333343465323635393839
          6638623963313135616434313165646232346132303338320a616137303230623436343031643436
          36613135363366303035653731616561333439383662383433346537643139653663396339346435
          6661313739643036360a393635313837346536633136303932316638386463343465376238373532
          6338
```

Time to test:

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1766853961910/eb5558d6-d0a3-4af5-aa50-2b999503f3ed.png align="center")

TADA! One more thing - let’s get rid of the ugly warning. Just create a a dummy inventory file.

```bash
 echo '[all]' > ~/my_ansible_secrets/dummy.ini
```

That’s it. You really should use and real password manager… Anyway - you probably still will want to keep some private vars - like username - outside your official repo. You can use “vars only inventory” technique whenever you need.