devoinc.secret

Secret

The debops.secret role allows you to have a separate folder on the Ansible Controller (different from your playbook and inventory folders) that serves as a useful "workspace" for other roles.

Here are some examples of how this role can be used in DebOps:

Password retrieval: You can look up passwords from the current role or from known locations for passwords from other roles. For instance, the debops.mariadb role can manage a user account in the database with a random password, which can then be looked up by another role to include in a generated configuration file.
Secure file storage: This role can store files safely, such as application keys generated on remote servers. For example, the debops.boxbackup role fetches client keys for backup purposes. It's important to protect this secret directory, possibly using an encrypted filesystem, as there is no built-in encryption.
Secure workspace: The debops.boxbackup role uses the secret directory to create and manage a Root CA for backup servers. Client and server certificates are automatically downloaded, signed, and uploaded to target servers.
Centralized backup: Specific roles like debops.sshd, debops.pki, and debops.monkeysphere have their own task lists that can be called by custom playbooks for backing up and restoring SSH host keys and SSL certificates. The created .tar.gz files are stored in the secret directory on the Ansible Controller.