Remote passwords are not included in the playbook but are in the individual host and group vault files.
These playbooks take advantage of vault files to store sensitive information. Example vault files are included but are not encrypted.
$ ansible-vault encrypt group_vars/proxmox/vault.yamlYou have two options to decrypt vaults at runtime.
- Create a vault password file
- Run playbook with
--ask-vault-password
Create a file called .vault_password_file in the playbook directory that contains same password used to encrypt your vault files. Protect it the same as you would a password.
$ ansible-playbook --ask-vault-password update-hosts.yml$ ansible-playbook update-hosts.yml