# Having private files for group\_vars, host\_vars etc.

**URL:** <https://forum.ansible.com/t/having-private-files-for-group-vars-host-vars-etc/13914>\
**Category:** Ansible Project\
**Created:** [November 15, 2013, 9:54am UTC](https://forum.ansible.com/t/having-private-files-for-group-vars-host-vars-etc/13914 "2013-11-15T09:54:57Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Dhananjay\_Nene](https://avatars.discourse-cdn.com/v4/letter/d/2acd7d/32.png) [@Dhananjay\_Nene](https://forum.ansible.com/u/Dhananjay_Nene)\
**Post date:** [November 15, 2013, 9:54am UTC](https://forum.ansible.com/t/having-private-files-for-group-vars-host-vars-etc/13914/1 "2013-11-15T09:54:57Z")

</div>

I find a need to maintain a set of of passwords which either should be encrypted or alternatively never checked into the project repository.

This is a variant of the earlier topic discussed at [https://groups.google.com/d/topic/ansible-project/jAX8N3RMr-I/discussion](https://groups.google.com/d/topic/ansible-project/jAX8N3RMr-I/discussion) ie. “Secret variables / data : encryption” which has already discussed the encryption issue and as far as I could understand no reasonable proposal has yet evolved to go forward.

I usually maintain separate files for sensitive variables (passwords etc.) which should not get checked into the version control repository. A convention I adopt is that any file or directory that begins with an underscore is never checked into the repo. Thats the convention I will use for this mail, though one could think of alternative conventions eg. files ending with “.private” etc.

Could we have a scenario where ansible looks up the files "_" + hosts\_file\_name, group\_vars/ __, host\_vars/\__ (alternatively \_group\_vars/_, \_host\_vars/_) as well ? These files can be used to store sensitive variables and will not get checked into the version control repository ?

I would be happy to contribute towards such a development, create and offer a pull request if this approach seems reasonable.

Note: These files could contain encrypted instead of plain-text variables as well as discussed in the earlier post I referred to, but thats a separate feature, so do not intend to conflate them here.

Regards,  
Dhananjay

---

<div class="post-metadata">

**Author:** ![Michael\_DeHaan2](https://avatars.discourse-cdn.com/v4/letter/m/da6949/32.png) [@Michael\_DeHaan2](https://forum.ansible.com/u/Michael_DeHaan2)\
**Post date:** [November 20, 2013, 3:56am UTC](https://forum.ansible.com/t/having-private-files-for-group-vars-host-vars-etc/13914/2 "2013-11-20T03:56:09Z")

</div>

Checking the stat for multiple files doesn’t seem difficult, though I would worry a bit that (A) these files are easy to check in accidentally, and (B) the idea of doing vault in 1.5 would be more useful and we should do that instead.