From home-lab-ops
Streamlines Ansible Vault secret management for the olympus cluster — scaffolds new secrets, validates vault references, and guides rotation workflows
How this skill is triggered — by the user, by Claude, or both
Slash command
/home-lab-ops:vault-helperThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
All secrets live in a single encrypted vault file:
All secrets live in a single encrypted vault file:
ansible/inventory/group_vars/all/all.yml
This file is encrypted with Ansible Vault and requires ~/.vault_pass.txt to edit.
cd ansible
# Open for editing (decrypts in-place, re-encrypts on save)
ansible-vault edit inventory/group_vars/all/all.yml \
--vault-password-file ~/.vault_pass.txt
# View without editing
ansible-vault view inventory/group_vars/all/all.yml \
--vault-password-file ~/.vault_pass.txt
# Decrypt to plain text (CAREFUL — do not commit decrypted file)
ansible-vault decrypt inventory/group_vars/all/all.yml \
--vault-password-file ~/.vault_pass.txt
Convention: all vault variables are prefixed with vault_:
vault_<service>_<credential_type>: <secret_value>
# Examples:
vault_grafana_admin_password: supersecret
vault_pbs_api_token: user@pbs!tokenid=secret
vault_zeus_discord_token: Bot abc123xyz
vault_idrac_password: dell_root_password
ansible-vault edit inventory/group_vars/all/all.yml \
--vault-password-file ~/.vault_pass.txt
Add the new variable in the appropriate section. Keep related secrets grouped.
In the role's tasks/setup.yml, reference as {{ vault_<name> }}:
- name: Set service password
ansible.builtin.template:
src: config.yml.j2
dest: /etc/service/config.yml
vars:
password: "{{ vault_grafana_admin_password }}"
Or pass via environment variable in Docker Compose:
# In a template file
environment:
- GF_SECURITY_ADMIN_PASSWORD={{ vault_grafana_admin_password }}
defaults/main.yml# roles/<role>/defaults/main.yml
# Do NOT put real values here — this is for documentation only
grafana_admin_password: "{{ vault_grafana_admin_password }}"
When setting up a new service, these variables typically need to be vaulted:
| Service Type | Required Secrets |
|---|---|
| Monitoring exporter | vault_<exporter>_api_token, vault_<exporter>_password |
| Discord bot | vault_<agent_name>_discord_token |
| Proxmox API user | vault_proxmox_api_token_secret |
| PBS integration | vault_pbs_api_token |
| External service | vault_<service>_api_key |
| Database | vault_<db>_password, vault_<db>_root_password |
Verify every vault_* variable used in tasks has a corresponding vault entry:
# Find all vault variable references in roles:
grep -r "vault_" ansible/roles/ --include="*.yml" | grep -v "^#" | \
grep -oP 'vault_\w+' | sort -u
# Compare against what's in the vault:
ansible-vault view inventory/group_vars/all/all.yml \
--vault-password-file ~/.vault_pass.txt | grep "^vault_" | \
awk '{print $1}' | sort -u
Any variable in the first list but not the second needs to be added to the vault.
grep -r "vault_<old_var_name>" ansible/ --include="*.yml"
# Also check templates:
grep -r "vault_<old_var_name>" ansible/roles/*/templates/
(Log into the service — Grafana, PBS, Proxmox API, Discord portal, etc. — and rotate the credential there first)
ansible-vault edit inventory/group_vars/all/all.yml \
--vault-password-file ~/.vault_pass.txt
# Update the value
cd ansible
ansible-playbook -i inventory/hosts.yml service_vms.yml \
--tags <affected_service> \
--vault-password-file ~/.vault_pass.txt
Confirm the service is working with the new credential before committing.
See references/vault-patterns.md for the complete list of expected vault variables and their purpose.
npx claudepluginhub infiquetra/infiquetra-claude-plugins --plugin home-lab-opsGuides Ansible Vault secrets management: encrypting variables/files, vault passwords, vault IDs, and security hardening for playbooks.
Retrieves secrets securely in Ansible playbooks using Infisical vault integration, no_log directives, environment fallbacks, and reusable lookup tasks for credentials like Proxmox or DB passwords.
Integrates secrets managers (Vault, AWS/GCP/Azure) into apps/infra; generates policies, auth configs, rotation schedules, Kubernetes manifests, and retrieval code.