secure: implement ansible vault and isolate client secrets

.gitlab-ci.yml

@@ -22,5 +22,7 @@ deploy_application:
   image: docker:24.0.7-cli
   script:
     - docker pull nginxdemos/hello:plain-text
-    # FIXED: Now pointing to the local path inside the repository root
     - docker compose -f ./stacks/hello-world/docker-compose.yml up -d
+    # Added bonus: Re-running ansible safely in pipeline if configuration changes
+    # - echo "$ANSIBLE_VAULT_PASSWORD" > .vault_pass
+    # - ansible-playbook -i hosts.ini main.yml --vault-password-file .vault_pass

main.yml

@@ -1,16 +1,19 @@
 ---
-- name: Provision Foundation & Operations Stage (v0.1 & v0.2)
+- name: Provision Production DevOps Platform Toolkit
   hosts: all
   become: yes
+  vars_files:
+    - vars/vault.yml # Dynamically loads the encrypted secrets
   vars:
     server_timezone: "Europe/Amsterdam"
     client_admin_user: "ansible"
-    client_admin_ssh_pub_key: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIwGQCc/zdN16mRdviHD7VCmisZnippyVMjvH5GHFVGH ansible-lab"
     ssh_port: "22"
-    ssl_notification_email: "mhdio.mail@gmail.com"
-    # Primary domain configuration
     client_domain: "lab.mhdio.com"
     
+    # Binding plaintext vars to encrypted vault values
+    client_admin_ssh_pub_key: "{{ vault_client_admin_ssh_pub_key }}"
+    ssl_notification_email: "{{ vault_ssl_notification_email }}"
+
   roles:
     # -----------------------------------------------------------------
     # Foundation Stage (v0.1)

vars/vault.yml

@@ -0,0 +1,17 @@
+$ANSIBLE_VAULT;1.1;AES256
+62623132383465633366366462326534613633663830366463306363396532363235376161313063
+3365326234386633323866663663343934643238613363360a356438663466616337306231616633
+62303366343737663837643563616363303664323632346366303662353138616365623035623333
+6436643039383837330a666363346337306434306131636464613563623930643634343733383735
+37623131313665306262363533383764663963363263613134306262356361663330363435363566
+33363765313863653033616434383334346232623538323636383365663234643762646131363034
+61323734623439636435383631343539326565373961646366373430613761356265336666306666
+38326136363636393438303162333164313833326533373462643637633262626266666563313839
+62666365363662323235613537666435323635646462643831373932376463346637653538643966
+32623134303733353163643066613334316333663133346339613637323362636431366233336466
+65646634313830356464336331353032346636366162343638613538303336326163303630303132
+61656338316231613765343338373561616532393431336632653735353438343665323630653131
+62613165373539386135366665366632393863333037653831393037653837353537353939663938
+63646165353863393765643362303635363633343333373264383031366138373265303761633333
+62633239346531366464386666363937646536306433356663343564306531666235366339333935
+64653661386636316137