# Save files encrypted with ansible vault

**URL:** <https://forum.ansible.com/t/save-files-encrypted-with-ansible-vault/45492>\
**Category:** Get Help\
**Created:** [March 5, 2026, 8:40pm UTC](https://forum.ansible.com/t/save-files-encrypted-with-ansible-vault/45492 "2026-03-05T20:40:10Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![DengelFred](https://avatars.discourse-cdn.com/v4/letter/d/87869e/32.png) [@DengelFred](https://forum.ansible.com/u/DengelFred)\
**Post date:** [March 5, 2026, 8:40pm UTC](https://forum.ansible.com/t/save-files-encrypted-with-ansible-vault/45492/1 "2026-03-05T20:40:10Z")

</div>

Hello,

I have a playbook to create wireguard configurations for an opnsense and would like to save the generated client configuration encrypted. It runs inside a devcontainer and the password is available in /run/secrets/ansible\_vault (checked)

```yaml
- name: Check the vault password
  no_log: true
  vars:
    _vault_pass: "{{ lookup('file', '/run/secrets/ansible_vault') }}"
  ansible.builtin.assert:
    that: _vault_pass | length > 0
    fail_msg: "Could not read vault password"

- name: Save WireGuard config encrypted
  no_log: true
  vars:
    _vault_pass: "{{ lookup('file', '/run/secrets/ansible_vault') }}"
    _wg_config: |
      [Interface]
      PrivateKey = {{ _client_privkey }}
      Address = {{ wg_client_ip }}
      DNS = {{ wg_server_ip }}

      [Peer]
      PublicKey = {{ wg_server_pubkey }}
      AllowedIPs = {{ wg_client_target_ips }}
      Endpoint = {{ wg_server_endpoint }}
      PersistentKeepalive = 25
  ansible.builtin.copy:
    content: "{{ _wg_config | ansible.builtin.vault(_vault_pass) }}"
    dest: "{{ wg_client_dir }}/{{ inventory_hostname }}.conf"
    mode: "0600"

```

Unfortunately the file is stored unencrypted - anyone an idea, why?  
Thanks a lot!  
Thomas

---

<div class="post-metadata">

**Author:** ![sivel](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/sivel/32/1198_2.png) [@sivel](https://forum.ansible.com/u/sivel)\
**Post date:** [March 5, 2026, 9:44pm UTC](https://forum.ansible.com/t/save-files-encrypted-with-ansible-vault/45492/2 "2026-03-05T21:44:10Z")

</div>

The default behavior of the copy module is to decrypt the data, by means of the default `decrypt=True`. Supplying `decrypt: false` should resolve the issue.

> **[Parameters - ansible.builtin.copy module – Copy files to remote locations —...](https://docs.ansible.com/projects/ansible/latest/collections/ansible/builtin/copy_module.html#parameter-decrypt)**
>
> Parameter

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/ansible/original/1X/1882d9a01da5d8996a862359b0913cc568a39b84.svg) [@system](https://forum.ansible.com/u/system)\
**Post date:** [April 4, 2026, 9:44pm UTC](https://forum.ansible.com/t/save-files-encrypted-with-ansible-vault/45492/3 "2026-04-04T21:44:52Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.