# Security question about a custom (in python) for accessing the gitlab API

**URL:** <https://forum.ansible.com/t/security-question-about-a-custom-in-python-for-accessing-the-gitlab-api/18643>\
**Category:** Ansible Project\
**Created:** [June 30, 2015, 2:57pm UTC](https://forum.ansible.com/t/security-question-about-a-custom-in-python-for-accessing-the-gitlab-api/18643 "2015-06-30T14:57:17Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Boris\_Muhmer](https://avatars.discourse-cdn.com/v4/letter/b/71e660/32.png) [@Boris\_Muhmer](https://forum.ansible.com/u/Boris_Muhmer)\
**Post date:** [June 30, 2015, 2:57pm UTC](https://forum.ansible.com/t/security-question-about-a-custom-in-python-for-accessing-the-gitlab-api/18643/1 "2015-06-30T14:57:17Z")

</div>

I am pretty new to Ansible and this group, so just a quick “Hello” to everyone!  
For my 1st questions I already got quick answers using IRC, but now I think a mail would be better.

The problem I have is the following: during the setup of virtual hosts I generate new users, with SSH key-pairs, and I checkout git repositories from our gitlab server.

For the git checkout we use deploy only keys. So I need to add the generated public SSH key from the special virtual host user to the project in gitlab.  
I just wrote a little python script - as a proof of concept - to add a public SSH key to a project, so no bid deal at all.

But I have to specify either some credentials or a token for an administrative gitlab user, and I am stuck how to do this.

I came up with two strategies:

1. Copy the python script, that installs the key in the project to the server, and pass the “secret” token using an environment variable to the script.
2. Copy the public SSH key to the system, that excutes the playbook, and run the python script.

What I don’t like about the 1st approach is, that I have to install a python library (“pyapi-gitlab”), which isn’t really needed on the target server. Also I am not sure if my ideas are good practice.

So, do You have any suggestions (or pointers to best practices) what I should do?

Thanks in advance!

Regards,  
Boris

---

<div class="post-metadata">

**Author:** ![Brian\_Coca](https://avatars.discourse-cdn.com/v4/letter/b/6de8d8/32.png) [@Brian\_Coca](https://forum.ansible.com/u/Brian_Coca)\
**Post date:** [July 1, 2015, 6:07pm UTC](https://forum.ansible.com/t/security-question-about-a-custom-in-python-for-accessing-the-gitlab-api/18643/2 "2015-07-01T18:07:22Z")

</div>

you can use vars\_prompt or a store the credentials in a vault and then  
pass those as arguments to the script.

---

<div class="post-metadata">

**Author:** ![Boris\_Muhmer](https://avatars.discourse-cdn.com/v4/letter/b/71e660/32.png) [@Boris\_Muhmer](https://forum.ansible.com/u/Boris_Muhmer)\
**Post date:** [July 2, 2015, 5:54am UTC](https://forum.ansible.com/t/security-question-about-a-custom-in-python-for-accessing-the-gitlab-api/18643/3 "2015-07-02T05:54:58Z")

</div>

I will have a closer look at this “vault” stuff.  
Thank You for the input!

Regards,  
Boris