# Secret hostvars... how to deal with them?

**URL:** <https://forum.ansible.com/t/secret-hostvars-how-to-deal-with-them/18755>\
**Category:** Ansible Project\
**Created:** [July 14, 2015, 11:06am UTC](https://forum.ansible.com/t/secret-hostvars-how-to-deal-with-them/18755 "2015-07-14T11:06:37Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Adam\_Flinton](https://avatars.discourse-cdn.com/v4/letter/a/b782af/32.png) [@Adam\_Flinton](https://forum.ansible.com/u/Adam_Flinton)\
**Post date:** [July 14, 2015, 11:06am UTC](https://forum.ansible.com/t/secret-hostvars-how-to-deal-with-them/18755/1 "2015-07-14T11:06:37Z")

</div>

Dear All,

At the moment we are encrypting all of our host vars with git-crypt as a few contain secret information.

This is a pain as only a few people need the encrypted parts of the few encrypted files but it means all people who use ansible etc have to have git-crypt set up & working etc.etc.

So I would like to find out some way in which just the values which need to be encrypted can be pulled out into separate files & encrypted.

I see from:

[http://docs.ansible.com/intro\_inventory.html](http://docs.ansible.com/intro_inventory.html)

That a host/group var file can be replaced with a folder & then

“As an advanced use-case, you can create directories named after your groups or hosts, and Ansible will read all the files in these directories”

Such that I could have a file called notsecret & another called secret.key & tell git-crypt just to encrypt “\*.key” files.

That way people using instances/roles etc with no secret info could still use host/group vars w/o gitcrypt

At the moment this seems like the best plan…but any other suggestions would be welcome.

For example can a hostvar file perform an inclusion along the lines of including something akin to

vars\_files:

- [‘files/vars/{{ inventory\_host }}.yml’,‘files/vars/default.yml’]

?

TIA

Adam

---

<div class="post-metadata">

**Author:** ![Jaime\_Bermudez](https://avatars.discourse-cdn.com/v4/letter/j/e36b37/32.png) [@Jaime\_Bermudez](https://forum.ansible.com/u/Jaime_Bermudez)\
**Post date:** [July 14, 2015, 5:00pm UTC](https://forum.ansible.com/t/secret-hostvars-how-to-deal-with-them/18755/2 "2015-07-14T17:00:34Z")

</div>

We’ve had success storing secret variables in s3 YAML files and using include\_vars to process them where needed.

- Jaime