add support for secrets

The vault password is `sekrit`, and it only has a placeholder in it.  We
will re-key to a shared password before adding real secrets.

.gitignore

@@ -1,2 +1,3 @@
 .*.swp
 dev-hosts
+dev-secrets.yml

README.md

@@ -4,9 +4,19 @@ Run `ansible-playbook -i prod-hosts -s site.yml` to configure the production sit
 
 ## Development
 
-During development, you may create a `dev-hosts` file containing your test hosts.
+During development, you may create a `dev-hosts` file containing your test hosts, an an unencrypted `dev-secrets.yml` file containing any necessary (cleartext) secrets.
 Then run `ansible-playbook -s site.yml` to test your changes.
 
+## Secrets
+
+Secrets are stored in `secrets.yml` in the top-level directory, which is encrypted with [ansible-vault](http://docs.ansible.com/playbooks_vault.html).
+To run Ansible with these production secrets, you will need to supply a shared vault password.
+
+All secrets are loaded into Ansible variables.
+By convention, these variables should be named with the prefix `secret_`.
+
+You can edit the secrets with `ansible-vault edit secrets.yml`.
+
 # Other files:
 
  * buildbot.asc - Buildbot Release Team Keyring

roles/base/tasks/main.yml

@@ -1,4 +1,5 @@
 ---
+- include: secrets.yml
 - include: python.yml
 - include: sudo.yml
 - include: admin_users.yml

roles/base/tasks/secrets.yml

@@ -0,0 +1,4 @@
+- include_vars: {{ item }}
+  with_first_found:
+  - dev-secrets.yml
+  - secrets.yml

secrets.yml

@@ -0,0 +1,9 @@
+$ANSIBLE_VAULT;1.1;AES256
+63343763653639366436343837613263656137363132646161323333386263613831333634643765
+3161346365643864613664636139393033623166303466300a323437313437363465636135393735
+66393331393839376536306262383938663834333639643339306362303263666163333434616237
+3062313762616636360a653038323464633535666263386637666563323738613162656135386661
+66306165393066333039353832643336356336363836376362396237303938663864313764623465
+37626364303966663565663963663265313735303536653365643862633164373037356331393539
+64323764306530616534356338393233623138346331633132646132346563356438303164323836
+62386461306165653761