# Vault support for binary files

**URL:** <https://forum.ansible.com/t/vault-support-for-binary-files/19127>\
**Category:** Ansible Developer\
**Created:** [August 27, 2015, 4:58pm UTC](https://forum.ansible.com/t/vault-support-for-binary-files/19127 "2015-08-27T16:58:45Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Peter\_Loron](https://avatars.discourse-cdn.com/v4/letter/p/258eb7/32.png) [@Peter\_Loron](https://forum.ansible.com/u/Peter_Loron)\
**Post date:** [August 27, 2015, 4:58pm UTC](https://forum.ansible.com/t/vault-support-for-binary-files/19127/1 "2015-08-27T16:58:45Z")

</div>

Hello. Our fundamental issue is that we have secrets which are binary files (e.g. java keystore, etc) which we want to protect. Including them as a vault file in the role would be great, but there currently doesn’t seem to be a way to do this. The comments in the PR below have some discussion on the issue.

Extending the copy module to have a “vault” flag which would decrypt the file with the vault system and then upload it would be dandy.

Thoughts from the hive mind?

Thanks.

---

<div class="post-metadata">

**Author:** ![Jonathan\_Sabo](https://avatars.discourse-cdn.com/v4/letter/j/bb73d2/32.png) [@Jonathan\_Sabo](https://forum.ansible.com/u/Jonathan_Sabo)\
**Post date:** [August 27, 2015, 5:00pm UTC](https://forum.ansible.com/t/vault-support-for-binary-files/19127/2 "2015-08-27T17:00:40Z")

</div>

Checkout credstash.

[http://docs.ansible.com/ansible/playbooks\_lookups.html#the-credstash-lookup](http://docs.ansible.com/ansible/playbooks_lookups.html#the-credstash-lookup)

[https://github.com/LuminalOSS/credstash/](https://github.com/LuminalOSS/credstash/)

---

<div class="post-metadata">

**Author:** ![Peter\_Loron](https://avatars.discourse-cdn.com/v4/letter/p/258eb7/32.png) [@Peter\_Loron](https://forum.ansible.com/u/Peter_Loron)\
**Post date:** [August 27, 2015, 5:06pm UTC](https://forum.ansible.com/t/vault-support-for-binary-files/19127/3 "2015-08-27T17:06:01Z")

</div>

Credstash looks great…except that we’re not using AWS.

---

<div class="post-metadata">

**Author:** ![Brian\_Coca](https://avatars.discourse-cdn.com/v4/letter/b/6de8d8/32.png) [@Brian\_Coca](https://forum.ansible.com/u/Brian_Coca)\
**Post date:** [August 27, 2015, 5:07pm UTC](https://forum.ansible.com/t/vault-support-for-binary-files/19127/4 "2015-08-27T17:07:02Z")

</div>

it is on my list and there are already a few feature requests to add  
'transparent' copy of vault files. I'll be very happy if anyone beats  
me to it.

---

<div class="post-metadata">

**Author:** ![Jonathan\_Sabo](https://avatars.discourse-cdn.com/v4/letter/j/bb73d2/32.png) [@Jonathan\_Sabo](https://forum.ansible.com/u/Jonathan_Sabo)\
**Post date:** [August 27, 2015, 5:10pm UTC](https://forum.ansible.com/t/vault-support-for-binary-files/19127/5 "2015-08-27T17:10:32Z")

</div>

You could also base64 encode the file first and then decode it.

---

<div class="post-metadata">

**Author:** ![esco\_real](https://avatars.discourse-cdn.com/v4/letter/e/c89c15/32.png) [@esco\_real](https://forum.ansible.com/u/esco_real)\
**Post date:** [August 28, 2015, 8:51pm UTC](https://forum.ansible.com/t/vault-support-for-binary-files/19127/6 "2015-08-28T20:51:41Z")

</div>

Base64 works for me, too. But it would be nice if the copy module would support “content” in Base64.

At the moment I use the shell module:

- shell: echo ‘{{ file\_name }}’ | base64 --decode \> /path/file\_name

I use Keepass to store the base64 code. But this shouldn’t make any difference…